Security Bulletin
Summary
There are vulnerabilities in the Linux kernel to which the IBM FlashSystemâ„¢ 840 and FlashSystem 900 are susceptible (CVE-2019-11477, CVE-2019-11478, and CVE-2019-11479). An exploit of these vulnerabilities could allow a remote attacker to cause a denial of service condition.
Vulnerability Details
DESCRIPTION: Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/162665 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2019-11477
DESCRIPTION: Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/162662 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2019-11478
DESCRIPTION: Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/162664 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
Storage Node machine type and models (MTMs) affected:
- 9846-AE1 and 9848-AE1
- 9846-AE2 and 9848-AE2
- 9846-AE3 and 9848-AE3
- VRMFs prior to 1.5.2.6
- VRMFs prior to 1.6.1.1
Remediation/Fixes
MTMs | VRMF | APAR | Remediation/First Fix |
FlashSystem 840 MTMs:
9840-AE1 and 9843-AE1 FlashSystem 900 MTMs: 9843-UF3, 9840-AE2, 9843-AE2, 9840-AE3, and 9843-AE3 |
Code fixes are now available, the minimum VRMF containing the fix depending on the code stream: Fixed Code VRMF: 1.6 stream: 1.6.1.1 1.5 stream: 1.5.2.6 |
N/A | FlashSystem 840 and FlashSystem 900 fixes are available at IBM's Fix Central website. |
Workarounds and Mitigations
Get Notified about Future Security Bulletins
References
Acknowledgement
Jonathan Looney discovered these vulnerabilities.
Change History
17 Dec 2019: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
17 February 2023
UID
ibm11137802