CVE-2019-5599
In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.08%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 5.08% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-770
- Affected
- freebsd/freebsd
- Source
- secteam@freebsd.org
References
- http://packetstormsecurity.com/files/153329/Linux-FreeBSD-TCP-Based-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/153378/FreeBSD-Security-Advisory-FreeBSD-SA-19-08.rack.htmlThird Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/06/17/5Mailing List, Third Party Advisory
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.mdMitigation, Third Party Advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193Third Party Advisory
- https://seclists.org/bugtraq/2019/Jun/27Mailing List, Mitigation, Patch, Third Party Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-19:08.rack.ascMitigation, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20190625-0004/Third Party Advisory
- https://support.f5.com/csp/article/K75521003Third Party Advisory
- https://www.kb.cert.org/vuls/id/905115Third Party Advisory, US Government Resource
- http://packetstormsecurity.com/files/153329/Linux-FreeBSD-TCP-Based-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/153378/FreeBSD-Security-Advisory-FreeBSD-SA-19-08.rack.htmlThird Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/06/17/5Mailing List, Third Party Advisory
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.mdMitigation, Third Party Advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193Third Party Advisory
- https://seclists.org/bugtraq/2019/Jun/27Mailing List, Mitigation, Patch, Third Party Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-19:08.rack.ascMitigation, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20190625-0004/Third Party Advisory
- https://support.f5.com/csp/article/K75521003Third Party Advisory
- https://www.kb.cert.org/vuls/id/905115Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.