7.8

CVE-2019-11477

Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.29 < 3.16.69
Linux ≫ Linux Kernel Version >= 3.17 < 4.4.182
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.182
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.127
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.52
Linux ≫ Linux Kernel Version >= 4.20 < 5.1.11
F5 ≫ Big-ip Advanced Firewall Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Advanced Firewall Manager Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Advanced Firewall Manager Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Access Policy Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Access Policy Manager Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Access Policy Manager Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Access Policy Manager Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Access Policy Manager Version15.0.0
F5 ≫ Big-ip Application Acceleration Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Application Acceleration Manager Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Application Acceleration Manager Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Application Acceleration Manager Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Link Controller Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Link Controller Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Link Controller Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Link Controller Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Link Controller Version15.0.0
F5 ≫ Big-ip Policy Enforcement Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Policy Enforcement Manager Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Policy Enforcement Manager Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Webaccelerator Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Webaccelerator Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Webaccelerator Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Webaccelerator Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Webaccelerator Version15.0.0
F5 ≫ Big-ip Application Security Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Application Security Manager Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Application Security Manager Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Application Security Manager Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Local Traffic Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Local Traffic Manager Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Local Traffic Manager Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Local Traffic Manager Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Local Traffic Manager Version15.0.0
F5 ≫ Big-ip Fraud Protection Service Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Fraud Protection Service Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Fraud Protection Service Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Fraud Protection Service Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Global Traffic Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Global Traffic Manager Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Global Traffic Manager Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Global Traffic Manager Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Global Traffic Manager Version15.0.0
F5 ≫ Big-ip Analytics Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Analytics Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Analytics Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Analytics Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Analytics Version15.0.0
F5 ≫ Big-ip Edge Gateway Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Edge Gateway Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Edge Gateway Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Edge Gateway Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Edge Gateway Version15.0.0
F5 ≫ Big-ip Domain Name System Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Domain Name System Version >= 12.1.0 <= 12.1.4
F5 ≫ Big-ip Domain Name System Version >= 13.1.0 <= 13.1.1
F5 ≫ Big-ip Domain Name System Version >= 14.0.0 <= 14.1.0
F5 ≫ Big-ip Domain Name System Version15.0.0
Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version14.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.10
Canonical ≫ Ubuntu Linux Version19.04
Redhat ≫ Enterprise Linux Version5.0
Redhat ≫ Enterprise Linux Version6.0
Redhat ≫ Enterprise Linux Version7.0
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Aus Version6.5
Redhat ≫ Enterprise Linux Aus Version6.6
Redhat ≫ Enterprise Linux Eus Version7.4
Redhat ≫ Enterprise Linux Eus Version7.5
Redhat ≫ Enterprise Mrg Version2.0
Ivanti ≫ Connect Secure Version-
F5 ≫ Traffix Signaling Delivery Controller Version >= 5.0.0 <= 5.1.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 71.15% 0.987
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 7.8 10 6.9
AV:N/AC:L/Au:N/C:N/I:N/A:C
security@ubuntu.com 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

https://www.kb.cert.org/vuls/id/905115
Third Party Advisory
US Government Resource
https://www.us-cert.gov/ics/advisories/icsa-19-253-03
Third Party Advisory
US Government Resource