Description
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | No fix yet | — |
| Debian 13 | linux | No fix yet | — |
| Debian 12 | linux | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | kernel-docs | 3.0.101-94.2 | SUSE-SU-2017:0437-1 |
| SLES 11 SP4 | kernel-ec2 +8 | 3.0.101-94.1 | SUSE-SU-2017:0437-1 |
| SLES 11 SP3 | kernel-ec2 +7 | 3.0.101-0.47.96.1 | SUSE-SU-2017:0494-1 |
| SLES 11 SP2 | kernel-ec2 +6 | 3.0.101-0.7.53.1 | SUSE-SU-2017:0333-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 11 SP4 | kernel-ec2 +8 | 3.0.101-94.1 | SUSE-SU-2017:0437-1 |
| SLE Real Time 11 SP4 | kernel-rt +3 | 3.0.101.rt130-68.1 | SUSE-SU-2017:1102-1 |
| SUSE OpenStack Cloud 5 | kernel-ec2 +6 | 3.0.101-0.47.96.1 | SUSE-SU-2017:0494-1 |
| SUSE Manager Proxy 2.1 | kernel-ec2 +6 | 3.0.101-0.47.96.1 | SUSE-SU-2017:0494-1 |
| SUSE Manager 2.1 | kernel-ec2 +6 | 3.0.101-0.47.96.1 | SUSE-SU-2017:0494-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | kernel-ec2 +6 | 3.0.101-0.47.96.1 | SUSE-SU-2017:0494-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 7
- Microsoft Windows - Malformed IP Options Denial of Service (MS05-019) EDB-942 · dos · Apr 17, 2005 · verified
- TCP Connection Reset - Remote Denial of Service EDB-291 · dos · Apr 23, 2004 · verified
- Multiple Vendor - TCP Sequence Number Approximation (4) EDB-24033 · remote · Apr 23, 2004 · verified
- Microsoft Windows XP/2000 - TCP Connection Reset EDB-276 · dos · Apr 22, 2004 · verified
- Multiple Vendor - TCP Sequence Number Approximation (2) EDB-24031 · remote · Apr 20, 2004 · verified
- Multiple Vendor - TCP Sequence Number Approximation (3) EDB-24032 · remote · Apr 20, 2004 · verified
- Multiple Vendor - TCP Sequence Number Approximation (1) EDB-24030 · remote · Mar 5, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- VDE-2024-017 Pepperl+Fuchs: ICE2- * and ICE3- * are affected by multiple vulnerabilities CERT@VDE · May 18, 2026
- SUSE-SU-2017:1102-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0494-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0333-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0437-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · May 2, 2025
References
- oval:org.mitre.oval:def:2689 vdb-entry signature
- oval:org.mitre.oval:def:3508 vdb-entry signature
- TA04-111A third-party-advisory
- oval:org.mitre.oval:def:5711 vdb-entry signature
- 20040425 Perl code exploting TCP not checking RST ACK. mailing-list
- SSRT061264 vendor-advisory
- http://www.uniras.gov.uk/vuls/2004/236929/index.htm
- MS06-064 vendor-advisory
- 11440 third-party-advisory
- http://kb.juniper.net/JSA10638
- https://kc.mcafee.com/corporate/index?page=content&id=SB10053
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- VU#415294 third-party-advisory
- SSRT4696 vendor-advisory
- MS05-019 vendor-advisory
- 20040420 TCP Vulnerabilities in Multiple IOS-Based Cisco Products vendor-advisory
- 10183 vdb-entry
- oval:org.mitre.oval:def:4791 vdb-entry signature
- oval:org.mitre.oval:def:270 vdb-entry signature
- tcp-rst-dos(15886) vdb-entry
- 4030 vdb-entry
- 22341 third-party-advisory
- ADV-2006-3983 vdb-entry
- 11458 third-party-advisory