CVE-2019-11477

What it actually does

Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs during TCP SACK processing allows remote attackers to cause kernel crashes or memory corruption leading to denial of service.

Why it matters to the business

Systems become unavailable or unstable when exposed to crafted network traffic, disrupting services and requiring restarts; high prevalence across Linux distributions and network appliances increases operational risk and patch urgency.

How an attack unfolds

An attacker sends specially crafted TCP packets containing malicious SACK options that trigger the integer overflow in the kernel's segment tracking logic, resulting in a crash without requiring authentication or user interaction.

How to fix it

Upgrade Linux kernel to one of the fixed releases 4.4.182, 4.9.182, 4.14.127, 4.19.52 or 5.1.11 (or later stable equivalents) and apply vendor patches for affected distributions and appliances such as Ubuntu, Red Hat Enterprise Linux, and F5 BIG-IP products.

How to confirm the fix worked

Verify running kernel version against the listed fixed releases; confirm absence of the vulnerable commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff; perform network fuzzing or regression tests exercising SACK handling.

Typical attack path

1. Identify reachable Linux-based hosts or network devices accepting TCP connections
2. Craft and transmit TCP segments with manipulated SACK blocks designed to overflow tcp_gso_segs
3. Trigger kernel panic or resource exhaustion causing service denial
4. Repeat or sustain traffic to maintain outage

How to detect it

Review system and kernel logs for unexpected panics or oops messages triggered by TCP processing; inspect network captures for repeated SACK-enabled segments with unusual option lengths; correlate with connection attempts from untrusted sources.

What your security team should do

• Prioritize patching internet-facing and high-value Linux systems due to very high EPSS score
• Implement network segmentation and TCP hardening where immediate upgrades are not feasible
• Monitor for kernel oops/panic logs and anomalous TCP traffic patterns
• Schedule validation scans after patching to confirm exposure removal