{"id":"CVE-2019-5599","aliases":["EUVD-2019-15174","GHSA-2c7c-f76h-r8hx","MGASA-2019-0195","MGASA-2019-0196","MGASA-2019-0197"],"status":"published","title":"In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non...","description":"In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05085,"percentile":0.92406,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770"],"published":"2019-06-21T01:07:01Z","modified":"2026-06-17T02:37:55Z","affected":[{"source":"osv","ecosystem":"Mageia:6","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.127-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.127-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.8-4.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.8-4.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-88.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"wireguard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20190601-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.127-1.mga6"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:6","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.127-1.mga6"}]}],"bundled":6}],"products":[{"vendor":"freebsd","product":"freebsd"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/06/17/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/153329/Linux-FreeBSD-TCP-Based-Denial-Of-Service.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-19:08.rack.asc","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/905115","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://seclists.org/bugtraq/2019/Jun/27","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Mitigation","Patch","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/153378/FreeBSD-Security-Advisory-FreeBSD-SA-19-08.rack.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://support.f5.com/csp/article/K75521003","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190625-0004/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5599"},{"url":"https://github.com/advisories/GHSA-2c7c-f76h-r8hx"},{"url":"https://advisories.mageia.org/MGASA-2019-0195.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24972","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.122","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.123","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.124","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.125","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.126","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.127","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0196.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24973","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24840","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.120","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.121","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0197.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24974","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-5599","description":"In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service.","status":"published","published":"2019-07-02T20:02:17Z","modified":"2024-08-04T20:01:51.99Z","updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2019-15174","description":"In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service.","status":"published","published":"2019-07-02T20:02:17Z","modified":"2024-08-04T20:01:51Z","updated_at":"2026-11-03T03:06:51.888651Z"}],"ghsa":[{"id":"GHSA-2c7c-f76h-r8hx","title":"In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non...","description":"In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service.","status":"published","published":"2022-05-24T16:49:17Z","modified":"2023-01-28T05:06:17Z","updated_at":"2026-11-02T14:44:25.398405Z"}],"nvd":[{"id":"CVE-2019-5599","description":"In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service.","status":"published","published":"2019-07-02T21:15:11.213Z","modified":"2026-06-17T02:37:55.047Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:05:17.695191Z"}],"osv":[{"id":"MGASA-2019-0195","title":"Updated kernel packages fix security vulnerability","description":"This kernel update is based on the upstream 4.14.127 and fixes at least\nthe following security issues:\n\nJonathan Looney discovered that it is possible to send a crafted sequence\nof SACKs which will fragment the RACK send map. An attacker may be able to\nfurther exploit the fragmented send map to cause an expensive linked-list\nwalk for subsequent SACKs received for that same TCP connection\n(CVE-2019-5599).\n\nJonathan Looney discovered that the TCP_SKB_CB(skb)-\u003etcp_gso_segs value\nwas subject to an integer overflow in the Linux kernel when handling TCP\nSelective Acknowledgments (SACKs). A remote attacker could use this to\ncause a denial of service (CVE-2019-11477).\n\nJonathan Looney discovered that the TCP retransmission queue implementation\nin tcp_fragment in the Linux kernel could be fragmented when handling\ncertain TCP Selective Acknowledgment (SACK) sequences. A remote attacker\ncould use this to cause a denial of service (CVE-2019-11478).\n\nJonathan Looney discovered that the Linux kernel default MSS is hard-coded\nto 48 bytes. This allows a remote peer to fragment TCP resend queues\nsignificantly more than if a larger MSS were enforced. A remote attacker\ncould use this to cause a denial of service (CVE-2019-11479).\n\nWireGuard has been updated to 0.0.20190601.\n\nFor other uptstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2019-06-21T01:07:01Z","modified":"2026-04-16T04:43:44.636229808Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2019-0196","title":"Updated kernel-tmb packages fix security vulnerability","description":"This kernel-tmb update is based on the upstream 4.14.127 and fixes at least\nthe following security issues:\n\nJonathan Looney discovered that it is possible to send a crafted sequence\nof SACKs which will fragment the RACK send map. An attacker may be able to\nfurther exploit the fragmented send map to cause an expensive linked-list\nwalk for subsequent SACKs received for that same TCP connection\n(CVE-2019-5599).\n\nA flaw was found in the Linux kernel's freescale hypervisor manager\nimplementation. A parameter passed via to an ioctl was incorrectly\nvalidated and used in size calculations for the page size calculation.\nAn attacker can use this flaw to crash the system or corrupt memory\nor, possibly, create other adverse security affects (CVE-2019-10142).\n\nJonathan Looney discovered that the TCP_SKB_CB(skb)-\u003etcp_gso_segs value\nwas subject to an integer overflow in the Linux kernel when handling TCP\nSelective Acknowledgments (SACKs). A remote attacker could use this to\ncause a denial of service (CVE-2019-11477).\n\nJonathan Looney discovered that the TCP retransmission queue implementation\nin tcp_fragment in the Linux kernel could be fragmented when handling\ncertain TCP Selective Acknowledgment (SACK) sequences. A remote attacker\ncould use this to cause a denial of service (CVE-2019-11478).\n\nJonathan Looney discovered that the Linux kernel default MSS is hard-coded\nto 48 bytes. This allows a remote peer to fragment TCP resend queues\nsignificantly more than if a larger MSS were enforced. A remote attacker\ncould use this to cause a denial of service (CVE-2019-11479).\n\nfs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out\nthe unused memory region in the extent tree block, which might allow\nlocal users to obtain sensitive information by reading uninitialized\ndata in the filesystem (CVE-2019-11833).\n\nIt also fixes an upstream regression that caused older 'legacy'\nbluetooth adapters to stop working (mga #24840).\n\nWireGuard has been updated to 0.0.20190601.\n\nFor other uptstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2019-06-21T01:07:01Z","modified":"2026-04-16T04:40:51.903468469Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2019-0197","title":"Updated kernel-linus packages fix security vulnerability","description":"This kernel-linus update is based on the upstream 4.14.127 and fixes at least\nthe following security issues:\n\nJonathan Looney discovered that it is possible to send a crafted sequence\nof SACKs which will fragment the RACK send map. An attacker may be able to\nfurther exploit the fragmented send map to cause an expensive linked-list\nwalk for subsequent SACKs received for that same TCP connection\n(CVE-2019-5599).\n\nA flaw was found in the Linux kernel's freescale hypervisor manager\nimplementation. A parameter passed via to an ioctl was incorrectly\nvalidated and used in size calculations for the page size calculation.\nAn attacker can use this flaw to crash the system or corrupt memory\nor, possibly, create other adverse security affects (CVE-2019-10142).\n\nJonathan Looney discovered that the TCP_SKB_CB(skb)-\u003etcp_gso_segs value\nwas subject to an integer overflow in the Linux kernel when handling TCP\nSelective Acknowledgments (SACKs). A remote attacker could use this to\ncause a denial of service (CVE-2019-11477).\n\nJonathan Looney discovered that the TCP retransmission queue implementation\nin tcp_fragment in the Linux kernel could be fragmented when handling\ncertain TCP Selective Acknowledgment (SACK) sequences. A remote attacker\ncould use this to cause a denial of service (CVE-2019-11478).\n\nJonathan Looney discovered that the Linux kernel default MSS is hard-coded\nto 48 bytes. This allows a remote peer to fragment TCP resend queues\nsignificantly more than if a larger MSS were enforced. A remote attacker\ncould use this to cause a denial of service (CVE-2019-11479).\n\nfs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out\nthe unused memory region in the extent tree block, which might allow\nlocal users to obtain sensitive information by reading uninitialized\ndata in the filesystem (CVE-2019-11833).\n\nIt also fixes an upstream regression that caused older 'legacy'\nbluetooth adapters to stop working (mga #24840).\n\nFor other uptstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2019-06-21T01:07:01Z","modified":"2026-04-16T04:42:48.996967942Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}