CVE-2019-5599

high-risk

Published 2019-07-02

In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service.

Do I need to act?

9.8% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (6)

Freebsd

Affected Vendors

Freebsd

References (20)

Third Party Advisory http://packetstormsecurity.com/files/153329/Linux-FreeBSD-TCP-Based-Denial-Of-Se...

Third Party Advisory http://packetstormsecurity.com/files/153378/FreeBSD-Security-Advisory-FreeBSD-SA...

Mailing List http://www.openwall.com/lists/oss-security/2019/06/17/5

Mitigation https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party...

Third Party Advisory https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193

Mailing List https://seclists.org/bugtraq/2019/Jun/27

Mitigation https://security.FreeBSD.org/advisories/FreeBSD-SA-19:08.rack.asc

Third Party Advisory https://security.netapp.com/advisory/ntap-20190625-0004/

Third Party Advisory https://support.f5.com/csp/article/K75521003

Third Party Advisory https://www.kb.cert.org/vuls/id/905115