CVE-2017-5972

moderate-risk

Published 2017-02-14

The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets, as demonstrated by an attack against the kernel-3.10.0 package in CentOS Linux 7. NOTE: third parties have been unable to discern any relationship between the GitHub Engineering finding and the Trigemini.c attack code.

Do I need to act?

18.9% chance of exploitation in next 30 days

EPSS score — higher than 81% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

41350

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (1)

Linux Kernel

Affected Vendors

Linux

References (18)

Mailing List http://seclists.org/oss-sec/2017/q1/573

Third Party Advisory http://www.securityfocus.com/bid/96231

Third Party Advisory https://access.redhat.com/security/cve/cve-2017-5972

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1422081

Exploit https://cxsecurity.com/issue/WLB-2017020112

Third Party Advisory https://githubengineering.com/syn-flood-mitigation-with-synsanity/

Exploit https://packetstormsecurity.com/files/141083/CentOS7-Kernel-Denial-Of-Service.ht...

Third Party Advisory https://security-tracker.debian.org/tracker/CVE-2017-5972

Third Party Advisory https://www.exploit-db.com/exploits/41350/