1

After upgrading Ubuntu 16.04 kernel to linux-image-4.4.0-151-generic some of our clients stopped being able to connect with TCP. Specifically using SSH.NET library from Windows servers with SFTP service provided by CrushFTP.

We had to rollback the upgrade, but the issues fixed in this kernel version look very serious (CVE-2019-11477, CVE-2019-11478 {SACK Panic}, CVE-2019-11479):

Version: 4.4.0-151.178  2019-06-19 13:11:04 UTC

  linux (4.4.0-151.178) xenial; urgency=medium

  * Remote denial of service (system crash) caused by integer overflow in TCP
    SACK handling (LP: #1831637)
    - SAUCE: tcp: limit payload size of sacked skbs
    - SAUCE: tcp: fix fack_count accounting on tcp_shift_skb_data()

  * Remote denial of service (resource exhaustion) caused by TCP SACK scoreboard
    manipulation (LP: #1831638)
    - SAUCE: tcp: tcp_fragment() should apply sane memory limits

 -- Stefan Bader <email address hidden> Tue, 11 Jun 2019 09:36:19 +0200

Do you know and can share any links for more information about similar problems experienced after upgrade to this specific Ubuntu kernel?

  • 1
    Seems vaguely related - it looks like the TCP fixes also broke Steam. The Linus pointed to a fix "tcp: refine memory limit test in tcp_fragment()" that is now included in kernel 5.1.14 and 4.19.55 but not yet in earlier longterm kernels 4.9.X and 4.4.X. I don't know if this is the same problem though. – Tometzky Jun 26 at 6:11
  • 2
    I guess a tcpdump/wireshark could help to pinpoint the issue, as like you state other product got the issues. The dump could help if you need special iptable rule or such to bypass the problem in exemple – yagmoth555 Jun 27 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.