Skip to content
OpenAdvisories
High SSA-462066 4 CVEs

SSA-462066: Vulnerability known as TCP SACK PANIC in Industrial Products

Published Sep 10, 2019 · Updated Apr 11, 2023 · Revision 22

Vendor: Siemens Product: RUGGEDCOM APE1404 Linux Product: RUGGEDCOM RM1224 family (6GK6108-4AM00) Product: RUGGEDCOM ROX II Product: RUGGEDCOM RX1400 VPE Debian Linux Product: RUGGEDCOM RX1400 VPE Linux CloudConnect Product: SCALANCE M804PB (6GK5804-0AP00-2AA2) Product: SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) Product: SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) Product: SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) Product: SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) Product: SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) Product: SCALANCE M874-2 (6GK5874-2AA00-2AA2) Product: SCALANCE M874-3 (6GK5874-3AA00-2AA2) Product: SCALANCE M875 Product: SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) Product: SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) Product: SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) Product: SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) Product: SCALANCE S602 Product: SCALANCE S612 Product: SCALANCE S615 (6GK5615-0AA00-2AA2) Product: SCALANCE S623 Product: SCALANCE S627-2M Product: SCALANCE SC622-2C (6GK5622-2GS00-2AC2) Product: SCALANCE SC632-2C (6GK5632-2GS00-2AC2) Product: SCALANCE SC636-2C (6GK5636-2GS00-2AC2) Product: SCALANCE SC642-2C (6GK5642-2GS00-2AC2) Product: SCALANCE SC646-2C (6GK5646-2GS00-2AC2) Product: SCALANCE W-1700 IEEE 802.11ac family +81 more

Summary

Multiple industrial products are affected by a vulnerability in the kernel known as TCP SACK PANIC. The vulnerability could allow a remote attacker to cause a denial of service condition.

Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

Vulnerabilities 4

  • High 7.5
    CVE-2019-11477 Public exploit EPSS 99%

    Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs

    Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fi…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.3
    CVE-2019-11478 Public exploit EPSS 94%

    SACK can cause extensive memory use via fragmented resend queue

    Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of serv…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.3
    CVE-2019-11479 EPSS 91%

    Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fr…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2019-8460

    OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to…

Revision history

  1. #22

    Added fix for SIMATIC CP 443-1 and CP 443-1 Advanced

  2. #21

    No fix planned for SIMATIC NET CP 443-1

  3. #20

    Added solution for SIMATIC CP 442-1 RNA and SIMATIC CP 443-1 RNA

  4. #19

    Updated remediation for SIMATIC CP 1623; Added solution for SIMATIC RF600R family and clarified list of affected devices

  5. #18

    Readded SCALANCE S615 to the list of affected products

  6. #17

    Updated solution for SIMATIC CP 1623; Clarified that currently no remediation is planned for SIMATIC CP 442-1 RNA, SIMATIC CP 443-1 RNA, TIM 3V-IE and TIM 4R-IE devices

  7. #16

    Added solution for SIMATIC NET CM 1542-1

  8. #15

    Added solution for SIMATIC NET CP 1623 and SIMATIC NET CP 1628

  9. #14

    Added affected products TIM 3V-IE, TIM 3V-IE Advanced, TIM 3V-IE DNP3, TIM 4R-IE and TIM 4R-IE DNP3

  10. #13

    Added affected products SCALANCE S602, SCALANCE S612, SCALANCE S623, and SCALANCE S627-2M and added solution for SIMATIC ITC1500 (PRO), SIMATIC ITC1900 (PRO), and SIMATIC ITC2200 (PRO)

  11. #12

    Added solution for SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

  12. #11

    Added solution for SIMATIC MV500 and SCALANCE W1750D

  13. #10

    Added solution for SIMATIC RF18xC/CI

  14. #9

    Informed about successor product for SIMATIC Teleservice adapters

  15. #8

    Added products SIMATIC NET CP 443-1 OPC UA, CP 443-1 RNA, CP 442-1 RNA, CP 443-1, CP 443-1 Advanced and CP 343-1 Advanced. Included additional information to CP 1623 and CP 1628 regarding affected CVE. Added CVE-2019-8460 - affected products are identified accordingly.

  16. #7

    Added solution for ROX II

  17. #6

    Added solution for SINEMA Remote Connect Server, SCALANCE M-800 / S615 and RUGGEDCOM RM1224. Added products SIMATIC NET CP 1623 and CP 1628. Information regarding SIMATIC MV500 corrected

  18. #5

    Added solution for TIM 1531 IRC, for SIMATIC NET CP 1242-7, CP 1243-7 LTE (EU and US versions), CP 1243-1, CP 1243-8 IRC, CP 1543-1, CP 1542SP-1, CP 1542SP-1 IRC, CP 1543SP-1 and for SCALANCE W1700. Added products RUGGEDCOM APE1404 and RUGGEDCOM RX1400. Information regarding SINEMA Remote Connect Server corrected

  19. #4

    Added solution for SCALANCE W700. SIPLUS devices now explicitly mentioned in the list of affected products

  20. #3

    Added solution for SIMATIC MV500. Removed SIMATIC RF166C from affected products

  21. #2

    Added solution for SINUMERIK 840D sl, SINUMERIK 828D, SINUMERIK 808D

  22. #1

    Publication Date

References