Skip to content
OpenAdvisories
High USN-4017-1 2 CVEs

linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities

Published Jun 17, 2019 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Jonathan Looney discovered that the TCP retransmission queue implementation
in the Linux kernel could be fragmented when handling certain TCP Selective
Acknowledgment (SACK) sequences. A remote attacker could use this to cause
a denial of service. (CVE-2019-11478)

Jonathan Looney discovered that an integer overflow existed in the Linux
kernel when handling TCP Selective Acknowledgments (SACKs). A remote
attacker could use this to cause a denial of service (system crash).
(CVE-2019-11477)

Fixed packages 20

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS linux 4.4.0-151.178
Ubuntu · 16.04 LTS 16.04:LTS linux-aws 4.4.0-1085.96
Ubuntu · 16.04 LTS 16.04:LTS linux-aws-hwe 4.15.0-1041.43~16.04.1
Ubuntu · 16.04 LTS 16.04:LTS linux-azure 4.15.0-1047.51
Ubuntu · 16.04 LTS 16.04:LTS linux-gcp 4.15.0-1034.36~16.04.1
Ubuntu · 16.04 LTS 16.04:LTS linux-hwe 4.15.0-52.56~16.04.1
Ubuntu · 16.04 LTS 16.04:LTS linux-kvm 4.4.0-1048.55
Ubuntu · 16.04 LTS 16.04:LTS linux-oracle 4.15.0-1015.17~16.04.1
Ubuntu · 16.04 LTS 16.04:LTS linux-raspi2 4.4.0-1111.120
Ubuntu · 16.04 LTS 16.04:LTS linux-snapdragon 4.4.0-1115.121
Ubuntu · 18.04 LTS 18.04:LTS linux 4.15.0-52.56
Ubuntu · 18.04 LTS 18.04:LTS linux-aws 4.15.0-1041.43
Ubuntu · 18.04 LTS 18.04:LTS linux-azure 4.18.0-1020.20~18.04.1
Ubuntu · 18.04 LTS 18.04:LTS linux-gcp 4.15.0-1034.36
Ubuntu · 18.04 LTS 18.04:LTS linux-hwe 4.18.0-22.23~18.04.1
Ubuntu · 18.04 LTS 18.04:LTS linux-kvm 4.15.0-1036.36
Ubuntu · 18.04 LTS 18.04:LTS linux-oem 4.15.0-1043.48
Ubuntu · 18.04 LTS 18.04:LTS linux-oracle 4.15.0-1015.17
Ubuntu · 18.04 LTS 18.04:LTS linux-raspi2 4.15.0-1038.40
Ubuntu · 18.04 LTS 18.04:LTS linux-snapdragon 4.15.0-1055.59

Vulnerabilities 2

  • High 7.5
    CVE-2019-11477 Public exploit EPSS 99%

    Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs

    Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fi…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.3
    CVE-2019-11478 Public exploit EPSS 94%

    SACK can cause extensive memory use via fragmented resend queue

    Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of serv…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2019-11477
  • report
    https://ubuntu.com/security/CVE-2019-11478