TCP SACK Panics Linux Servers
Summary: Unit 42 reported three Linux kernel vulnerabilities - CVE-2019-11477, CVE-2019-11478, and CVE-2019-11479 - affecting all Linux operating systems running kernel 2.6.29 (released March 2009) or newer, allowing a remote attacker to trigger a kernel panic and put servers into a Denial of Service state, though remote code execution is not a concern. The flaw stems from the TCP Selective Acknowledgement (SACK) and Maximum Segment Size (MSS) implementation, where a remote user sets MSS to 48 bytes and sends crafted SACK packets to overflow the receiver's socket buffer; patches were released by RedHat, Ubuntu, and openSUSE.
What you should know: Shodan queries cited in the report found 1,944,975 Linux-based servers discoverable on the internet, including 543,797 running http on port 80 and 152,416 running sshd on port 22, all potential targets absent firewall rules or traffic control policies.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2019-11477CVE-2019-11478CVE-2019-11479
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026