• State Resolved
  • Locked Locked
  • Replies 3 replies
  • Subscribers 98 subscribers
  • Views 588 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Linux/AM5728: Processor-SDK Linux 6.00.00 - TCP SACK PANIC - Kernel vulnerabilities - CVE-2019-11477, CVE-2019-11478 & CVE-2019-11479

Michael.Nosthoff
Prodigy 10 points

Part Number: AM5728

Tool/software: Linux

Hi,

In June there was a bunch of Kernel Vulnerabilities made public which can be summarized by the Term "TCP SACK PANIC". Details can be found here: https://access.redhat.com/security/vulnerabilities/tcpsack

These CVEs were adressed by some kernel patches which were also backported to earlier versions. Namely 4.19.55 containes them for the 4.19 LTS Release.

The just released SDK 6.00.00 contains Kernel 4.19.38 and from what I can tell also doesn't contain any patches for these issues (also no manual backports).

I have no problem with applying them myself for our product firmware. But I wanted to ask if there is a specific reason why TI didn't include them in the last release. Was it just a timing issue or does TI not see them as critical enough? Or (even better) do these vulnerabilities not apply to ARM based kernels? I couldn't find anything about it related to Sitara Products.

Regards,

Michael

  • 0
    TI__Mastermind 41450 points

    Hi,

    I will need to consult with the development team on your question. The only speculation I have for the moment would be that the reason for not including probably was timing related. Could also be the patches didn't integrate well per your manual back port suggestion.

    If you have a link to the patch series that you are looking at please attach to this thread, it would help to make sure we have alignment to what you are asking about.

    Best Regards,

    Schuyler 

  • 0 in reply to Schuyler Patton
    TI__Mastermind 41450 points

    Hi,

    After further research the reason for the patches not being included is due to timing with the release of the latest SDK. The patches became available in the community well after the kernel freeze date and during product testing. The patches should be avallable in the SDK targeted for the October timeframe.

    I would recommend that you should apply the patches if you feel you need them before then.

    Best Regards,

    Schuyler

  • 0 in reply to Schuyler Patton
    Intellectual 290 points

    Hi Schuyler,

    thanks for the quick response. To bad it didn't make the cut, but at least i know it's necessary.

    For whom it may concern, these patches are the relevant ones. They apply clean to the 06.00.00 Release Kernel:

    from v4.19.52
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.19.y&id=c09be31461ed140976c60a87364415454a2c3d42 CVE-2019-11477 tcp: limit payload size of sacked skbs; CVE-2019-11477 -- u16 overflow of TCP_SKB_CB(skb)->tcp_gso_segs
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.19.y&id=ec83921899a571ad70d582934ee9e3e07f478848 CVE-2019-11478 tcp: tcp_fragment() should apply sane memory limits -- CVE-2019-11478 : tcp_fragment, prevent fragmenting a packet when the socket is already using more than half the allowed space
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.19.y&id=7f9f8a37e563c67b24ccd57da1d541a95538e8d9 tcp: add tcp_min_snd_mss sysctl -- CVE-2019-11479 -- tcp mss hardcoded to 48
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.19.y&id=59222807fcc99951dc769cd50e132e319d73d699 tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() -- CVE-2019-11479 -- tcp mss hardcoded to 48

from 4.19.55:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.19.y&id=dad3a9314ac95dedc007bc7dacacb396ea10e376 tcp: refine memory limit test in tcp_fragment() -- CVE-2019-11478

    Regards,

    Michael