Description
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | No fix yet | — |
| Debian 13 | linux | No fix yet | — |
| Debian 12 | linux | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | kernel | 5.10.78.1-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
mrclki/sockstress ★ 17 · May 6, 2016
Sockstress (CVE-2008-4609) DDoS implementation written in Go
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://blog.robertlee.name/2008/10/conjecture-speculation.html
- https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html
- HPSBMI02473 vendor-advisory
- [dailydave] 20081002 TCP Resource Exhaustion DoS Attack Speculation mailing-list
- http://insecure.org/stf/tcp-dos-attack-explained.html
- http://www.outpost24.com/news/news-2008-10-02.html
- http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf
- 20090908 TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products vendor-advisory
- TA09-251A third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
- 20081017 Cisco Response to Outpost24 TCP State Table Manipulation Denial of Service Vulnerabilities vendor-advisory
- MS09-048 vendor-advisory
- http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked
- oval:org.mitre.oval:def:6340 vdb-entry signature
- MDVSA-2013:150 vendor-advisory