Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2019-11479

Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.

CVSS 7.5 · HighBuzz score 32.5

Buzz score

Why this CVE is surfacing

Buzz score total 32.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 19.5 · diversity 13.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
19.5
6 evidence mentions in the snapshot
Diversity score
13.0
4 sources across 2 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
6 source links · newest first
  • Tens of VMware Products affected by SACK Panic and SACK Slowness flawsSecurity Affairs

    Tens of VMware products are affected by recently discovered SACK Panic and SACK Slowness Linux kernel vulnerabilities. At least 30 VMware products are affected by recently discovered SACK Panic and SACK Slowness Linux kernel vulnerabilities. The vulnerabilities could be exploited by a remote unauthenticated attacker to trigger a denial-of-service (DoS) condition and reboot vulnerable systems. Impacted products […]

    newssecurityaffairs.comJul 4, 2019, 7:10 AM
  • Many VMware Products Affected by SACK Linux VulnerabilitiesSecurityWeek

    Over 30 VMware products are affected by SACK Panic and SACK Slowness , two recently disclosed Linux kernel vulnerabilities that can be exploited remotely without authentication for denial-of-service (DoS) attacks.

    newswww.securityweek.comJul 3, 2019, 12:11 PM
  • TCP SACK Panics Linux ServersUnit42

    The newly discovered Linux vulnerabilities, CVE-2019-11477, CVE-2019-11478, and CVE-2019-11479, affect all Linux operating systems newer than kernel 2.6.29 (released on March 2009) or above can cause a kernel panic to systems with services listening on TCP connection. This remote attack can put a server into Denial of Service (DoS) state, but remote code execution is not of concern.

    vendorunit42.paloaltonetworks.comJun 21, 2019, 2:30 PM
  • Serious Vulnerabilities in Linux Kernel Allow Remote DoS AttacksSecurityWeek

    A security researcher working for Netflix has discovered that the Linux kernel is affected by potentially serious vulnerabilities that can be exploited by a remote, unauthenticated attacker to launch denial-of-service (DoS) attacks.

    newswww.securityweek.comJun 18, 2019, 10:17 AM
  • SACK TCP flaws can crash, slow down Linux-based systemsHelp Net Security

    An engineering manager at Netflix has unearthed several TCP networking vulnerabilities in Linux and FreeBSD kernels that could lead to systems crashing or consuming too many resources and (consequently) slowing down. About the vulnerabilities The flaws were discovered by Jonathan Looney, who apart from working at Netflix is also a FreeBSD developer. They all affect the Selective Acknowledgments (SACK) TCP mechanism, which allows a receiving machine to acknowledge which data/packets it has received so that … More →

    newswww.helpnetsecurity.comJun 18, 2019, 10:13 AM
  • Multiple DoS vulnerabilities affect Linux and FreeBSDSecurity Affairs

    Netflix researcher has identified several TCP networking vulnerabilities in FreeBSD and Linux kernels that could trigger a DoS condition. Jonathan Looney, a security expert at Netflix, found three Linux DoS vulnerabilities, two of them related to the minimum segment size (MSS) and TCP Selective Acknowledgement (SACK) capabilities, and one related only to MSS. The most severe […]

    newssecurityaffairs.comJun 18, 2019, 7:49 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence