> Source: [sk156192](https://support.checkpoint.com/results/sk/sk156192)

# sk156192 - Check Point Response to CVE-2019-11477, CVE-2019-11478, CVE-2019-11479 - TCP SACK PANIC Linux Kernel vulnerabilities

| Property | Value |
|----------|-------|
| Solution ID | sk156192 |
| Date Created | 2019-06-18 |
| Last Modified | 2025-02-09 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server, Spark Firewall (Locally Managed), Cloud Firewall, Hardware, Scalable Platforms |
| Versions | R82.10, R82, R81.20, R82.10, R82, R81.20, R82.10, R82.00.X, R81.10.X, R82.10, Not Version-Specific, R82.10, R82, R81.20, R81.20, R82, R81.20, R82 |
| OS | Gaia |

## Symptoms

- Three related flaws were found in the Linux kernel's handling of TCP networking. The most severe vulnerability could allow a remote attacker to trigger a kernel panic in systems running the affected software and, as a result, impact the system's availability.

## Cause

[**CVE-2019-11477**](https://www.cve.org/CVERecord?id=CVE-2019-11477):

The Linux kernel is vulnerable to an integer overflow in the 16-bit width of *TCP_SKB_CB(skb)-\>tcp_gso_segs*. A remote attacker could exploit this to crash the system and create a Denial Of Service.

[**CVE-2019-11478**](https://www.cve.org/CVERecord?id=CVE-2019-11478):

The Linux kernel is vulnerable to a flaw that allows attackers to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. An attacker might be able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. This could cause the CPU to spend excessive time attempting to reconstruct the list creating a Denial Of Service.

[**CVE-2019-11479**](https://www.cve.org/CVERecord?id=CVE-2019-11479):

The Linux kernel is vulnerable to a flaw that allows attackers to send a crafted packets with low MSS values to trigger excessive resource consumption. An attacker can force the Linux kernel to segment its responses into multiple TCP segments, each of which contains only 8 bytes of data. This drastically increases the bandwidth required to deliver the same amount of data. Further, it consumes additional resources (CPU and NIC processing power). This attack requires continued effort from the attacker and the impacts will end shortly after the attacker stops sending traffic. While this attack is ongoing, the system will work at reduced capacity resulting in a Denial Of Service for some users.

## Solution

After having inspected the vulnerabilities and relevant patches, the impact to Check Point products is narrowed down to the list below.

Note that Check Point cloud services on relevant platforms were already patched on 18-June-2019.

### Vulnerability

* [CVE-2019-11477](https://www.cve.org/CVERecord?id=CVE-2019-11477) - The following releases are vulnerable:

  * R80.10 Security Management on Smart-1 appliances
  * R80.20 Security Management
  * R80.30 Security Management
  * R80.20 with kernel 3.10 (CloudGuard Network Security)
  * R80.30 with kernel 3.10 (16000 and 26000)
  * R80.20SP Maestro and Scalable Chassis
  * SMB / Quantum Spark (700 / 1200R / 1400)
* [CVE-2019-11478](https://www.cve.org/CVERecord?id=CVE-2019-11478) - All Check Point releases are vulnerable (as this already exists in Linux for many years).

* [CVE-2019-11479](https://www.cve.org/CVERecord?id=CVE-2019-11479) - Check Point is not vulnerable to this CVE (Check Point do not compile with the vulnerable code).

The vulnerabilities are relevant for local connections only (established TCP connections to or from the Security Gateway).  
Connections going through the Security Gateway for Deep Packet Inspection, and most connections to the Gateway Web Portals are not affected.

### Fix for Security Gateways and Management Servers

* **R77.30 Security Management Server and Security Gateway**

  Integrated in [R77.30 Jumbo Hotfix Accumulator](https://support.checkpoint.com/results/sk/sk106162) - Take 351 (and higher).
* **R80.10 Security Management Server and Security Gateway**

  Integrated in [R80.10 Jumbo Hotfix Accumulator](https://support.checkpoint.com/results/sk/sk116380) - Take 225 (and higher).
  > For Smart-1 525 / 5050 / 5150 - Download and install [R80.10 3.10 Kernel TCP SACK PANIC Hotfix](https://support.checkpoint.com/results/download/94643).
  >
  > Prerequisite - R80.10 Jumbo Hotfix Accumulator, Take 203.
* **R80.20 Security Management Server and Security Gateway**

  Integrated in [R80.20 Jumbo Hotfix Accumulator](https://support.checkpoint.com/results/sk/sk137592) - Take 87 (and higher).

  A new Hotfix is available on top of [R80.20 Jumbo Hotfix Accumulator - Take 87](https://support.checkpoint.com/results/sk/sk137592).  
  Show / Hide this section  
  > This hotfix enables the Security Gateway to remove the SACK-permitted option from the TCP headers of packets passing through it, thereby protecting the hosts behind the Security Gateway from attacks using the SACK feature of TCP. The new kernel parameter provided in the Hotfix will, when configured, force the Security Gateway to remove any existing SACK-permitted TCP option.
  >
  > **Important** - Removing the SACK-permitted option from the TCP headers can have a performance impact on the traffic passing through the Security Gateway. The impact depends on the quantity of lost packets.
  >
  > To get the Hotfix, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/).
  >
  > Procedure:
  > 1. Install the hotfix on the Security Gateway / each Cluster Member.
  >
  > 2. Edit the file `$FWDIR/boot/modules/fwkern.conf`:
  >
  >    1. Back up the file:
  >
  >       `cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}`
  >    2. Edit the file:
  >
  >       `vi $FWDIR/boot/modules/fwkern.conf`
  >    3. Add this line:
  >
  >       `tcp_sack_permitted_remove_option=1`
  >    4. Save the changes and exit Vi editor.
  >
  > 3. Edit the file `$PPKDIR/conf/simkern.conf`:
  >
  >    1. Back up the file:
  >
  >       `cp -v $PPKDIR/conf/simkern.conf{,_BKP}`
  >    2. Edit the file:
  >
  >       `vi $PPKDIR/conf/simkern.conf`
  >    3. Add this line:
  >
  >       `tcp_sack_permitted_remove_option=1`
  >    4. Save the changes and exit Vi editor.
  >
  > 4. Reboot the Security Gateway / each Cluster Member.

* **R80.30 Security Management Server and Security Gateway**

  Integrated in [R80.30 Jumbo Hotfix Accumulator](https://support.checkpoint.com/results/sk/sk153152) - Take 19 (and higher).
* **R80.30 with kernel 3.10 Security Gateway on 16000 / 26000 Appliances**

  Integrated in [Check Point R80.30 with Gaia 3.10](https://support.checkpoint.com/results/sk/sk152652) - Take 273 (and higher).
* **R80.20SP Maestro Security Group and Scalable Chassis (41000, 44000, 61000, 64000)**

  Integrated in [Jumbo Hotfix Accumulator for R80.20SP](https://support.checkpoint.com/results/sk/sk155832) - Take 105 (and higher).
* **SMB / Quantum Spark Gateway**

  * 700 / 1200R / 1400:

    Integrated in [R77.20.87 Jumbo Hotfix Accumulator](https://support.checkpoint.com/results/sk/sk153433) - Build 2960 (and higher).
  * 600 / 1100 / 1200R:

    [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.
* **R76SP Scalable Chassis (41000, 44000, 61000, 64000)**

  Integrated in [R76SP.50 Jumbo Hotfix Accumulator](https://support.checkpoint.com/results/sk/sk117633) - Take 196 (and higher).
* **CloudGuard Network Security for AWS / Azure / Google Cloud Platform**

  * R80.30 with kernel 2.6 Security Management Server:

    Integrated in [R80.30 Jumbo Hotfix Accumulator](https://support.checkpoint.com/results/sk/sk153152) - Take 19 (and higher).
  * R80.20 with kernel 3.10 Security Management Server:

    Integrated in [R80.20 with Gaia 3.10 Jumbo Hotfix Accumulator for AWS, Azure and Open Server Security Gateways](https://support.checkpoint.com/results/sk/sk146212) - Take 19 (and higher).
  * R80.20 with kernel 3.10 Security Gateway:

    Integrated in [R80.20 with Gaia 3.10 Jumbo Hotfix Accumulator for AWS, Azure and Open Server Security Gateways](https://support.checkpoint.com/results/sk/sk146212) - Take 19 (and higher).
  * R80.20 with kernel 2.6 Security Management Server:

    Integrated in [R80.20 Jumbo Hotfix Accumulator](https://support.checkpoint.com/results/sk/sk137592) - Take 87 (and higher).
  * R80.10 Security Management Server and Security Gateway:

    Refer to [sk136315 - Security Hotfix for CloudGuard](https://support.checkpoint.com/results/sk/sk136315).
  * R77.30 Security Management Server and Security Gateway:

    Refer to [sk136315 - Security Hotfix for CloudGuard](https://support.checkpoint.com/results/sk/sk136315).

### Lights Out Management (LOM) Cards

* 5100 / 5200 / 5400 / 5600 / 5800 / 5900 6500 / 6800 15400 / 15600 / 23500 / 23800 / 23900 Appliances:

  Integrated in firmware [v3.35g](https://support.checkpoint.com/results/download/97775).
* 13500 / 13800 21600 / 21700 / 21800 / Smart-1 225 / Smart-1 3050 / Smart-1 3150 Appliances:

  Integrated in firmware [v2.43n](https://support.checkpoint.com/results/download/97774).
* 4800 / 12200 / 12400 / 12600 TE250 / TE1000 Appliances:

  Integrated in firmware [v2.22](https://support.checkpoint.com/results/download/97776).

If you have applied the mitigation described below, we recommend to revert it after installing the fixed LOM card firmware:

1. Enable TCP SACK in the current session:  
   `echo 1 > /proc/sys/net/ipv4/tcp_sack`
2. Remove the relevant lines from the `/etc/rc.d/rc.local` script.

### Mitigation

If you cannot upgrade to the fixed version, then we recommend to disable the TCP SACK feature completely, at least for Internet-facing machines.

**Important** - Disabling TCP SACK can have an impact on performance (depending on the packet-loss rate) for the local connections only.

* On a Security Management Server and Security Gateway:

  1. Connect to the command line.

  2. Log in to the Expert mode.

  3. Disable TCP SACK in the current session:

     `echo 0 > /proc/sys/net/ipv4/tcp_sack`
  4. Disable TCP SACK during each boot:

     1. Back up the current script:

        `cp -v /etc/rc.d/rc.local{,_BKP}`
     2. Append the relevant command:

        `echo -e '\n#sk156192\nsysctl -w net.ipv4.tcp_sack=0\n' >> /etc/rc.d/rc.local`
* On an SMB / Quantum Spark Gateway:

  1. Connect to the command line.

  2. Log in to the Expert mode.

  3. Disable TCP SACK in the current session:

     `echo 0 > /proc/sys/net/ipv4/tcp_sack`
  4. Disable TCP SACK during each boot:

     1. Back up the current script:

        `cp -v /pfrm2.0/etc/platformInit{,_BKP}`
     2. Append the relevant command:

        `echo -e '\n#sk156192\necho 0 > /proc/sys/net/ipv4/tcp_sack\n' >> /pfrm2.0/etc/platformInit`
* On a Maestro Security Group and Scalable Chassis (41000, 44000, 61000, 64000):

  1. Connect to the command line.

  2. Log in to the Expert mode.

  3. Disable TCP SACK in the current session:

     `g_all echo 0 > /proc/sys/net/ipv4/tcp_sack`
  4. Disable TCP SACK during each boot:

     1. Back up the current script:

        `g_all cp -v /etc/rc.d/rc.local{,_BKP}`
     2. Append the relevant command:

        `g_all echo -e '\n#sk156192\nsysctl -w net.ipv4.tcp_sack=0\n' >> /etc/rc.d/rc.local`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content