Digi International Security Notice
Digi International Security Notice
CVE-2019-11477
CVE-2019-11478
CVE-2019-5599
CVE-2019-11479
June 25th, 2019
Overview
The purpose of this notice is to inform our customers of a
number of security vulnerabilities that are commonly called the “SACK”
vulnerabilities. This notice will cover which Digi products are impacted, what
steps customers can take to mitigate the risk, and what actions Digi recommends
to address this issue. The following
issues have been released:
CVE-2019-11477: SACK Panic (Linux >= 2.6.29). A sequence of
specifically crafted selective acknowledgements (SACK) may trigger an integer
overflow, leading to a denial of service or possible kernel failure (panic).
CVE-2019-11478: SACK Slowness (Linux < 4.15) or Excess
Resource Usage (all Linux versions). A sequence of specifically crafted
selective acknowledgements (SACK) may cause a fragmented TCP queue, with a
potential result in slowness or denial of service.
CVE-2019-5599: SACK Slowness (FreeBSD 12 using the RACK TCP
Stack). The TCP loss detection algorithm, Recent ACKnowledgment (RACK), uses
time and packet or sequence counts to detect losses. RACK uses linked lists to
track and identify missing packets. A sequence of specifically crafted acknowledgements
may cause the linked lists to grow very large, thus consuming CPU or network
resources, resulting in slowness or denial of service.
CVE-2019-11479: Excess Resource Consumption Due to Low MSS
Values (all Linux versions). The default maximum segment size (MSS) is
hard-coded to 48 bytes which may cause an increase of fragmented packets. This
vulnerability may create a resource consumption problem in both the CPU and
network interface, resulting in slowness or denial of service.
These vulnerabilities allow
for a Denial of Service (DoS) attack to be carried out against affected
devices. Of the four SACK vulnerabilities, CVE-2019-11477 carries the highest
CVE rating of 7.5. None of these vulnerabilities allow for privilege escalation
or sensitive data disclosure.
Researcher Credit
These vulnerabilities were discovered by Jonathan Looney at
Netflix.
See Netflix’s public bulletin: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md
Affected Products
The security team at Digi has evaluated this vulnerability to
Digi products and determined the overall risk to this vulnerability to Digi products
is Medium.
This rating is different from the standard CVSS scoring, as US-CERT scoring gave
this a 7.8 (high) rating. The US-CERT CVSS scoring is based on devices that
serve multiple users. In most uses, the Digi device is used as a single connection/device
control. Further, DoS attacks are inherently common among small IoT devices,
and these attacks can be done using standard normal networking techniques. DoS
attacks have significantly more risk if the service is a multi user service,
such as a web server. This is one of the critical reasons for the reduction of
the scoring. However, we do recommend steps you can take to protect your device
from this attack. See below for more details in the mitigations section.
The following products are impacted by:
CVE-2019-11477
(CVSS 7.8)
CVE-2019-11478 (CVSS 7.5)
CVE-2019-11479 (CVSS 7.5)
- Digi IX14 (planned fix release is 19.8)
- Digi EX15 (planned fix release is 19.8)
- Digi LR54 (planned fix release is 4.8)
- Digi WR54 and WR64 (planned
fix release is 4.8)
- Digi 6300-CX (planned fix release is 19.8)
- Digi 6310-DX (planned fix release is 19.8)
- Digi 6330-MX (planned fix release is 19.8)
- Digi AnywhereUSB
Plus 2, 8, and 24
- Digi ConnectPort
LTS 8, 16, and 32
- Digi Passport
- Digi CM
- Digi Connect IT
- WVA
- Xbee Gateway/Xbee
Industrial Gateway
- Digi Embedded Linux
(DEL)
- Digi Embedded Yocto
(DEY)
- Digi Embedded Android
(DEA)
The following products are only impacted by:
CVE-2019-11479
(CVSS 7.5)
- ConnectPort TS
- Connect ES
- Connect SP
- Connect WS
- AnywhereUSB (G2)
- Connect X4
- Connect X2
Note: If you have any questions on any Digi products and
services that are not listed, please contact us at +1 (952) 912-3456, or via
the web site at www.digi.com/support.
Detailed
Information on Affected products
Background
Digi maintains a security team that continuously reviews new
results as they are found from this threat and test solutions and products for
any new and emerging security vulnerabilities. Security is a top priority and
something we take very seriously.
Analysis
We have not replicated any of these vulnerabilities, however
they are very well understood and so we are assuming all our products listed
above are vulnerable and will act accordingly.
Again, these attacks only provide a DoS attack. No data exposure
or privilege escalation is possible using these attacks.
Functions impacted:
For every vulnerability, we review each one carefully to
determine the impact to our devices and services. We try to make a
recommendation to our customers on the anticipated impact of these
vulnerabilities. However, since we do not know each specific configuration and
data that our customers are using for our products and services, it is always
suggested that the customer review their unique situation and understand what
the risk could be to their environment. For embedded devices, the function
impacted can vary greatly by what features the customer has enabled or not
turned on.
Risk
For specific risks to Digi international products, we have classified
the risk of this vulnerability to our products as Medium.
During our analysis, we determined that this does not expose a DoS attack
vector that is easier to exploit than what inherently exists for most IoT
devices. Although US-CERT has rated this vulnerability as High (CVSS of 7.8), we
believe the real threat, given the nature of Digi devices and our recommended
customer hardening, to be much lower.
Risk of the SACK attack on the Digi products:
•
If the device is only exposed to trusted networks the attacker
has to come from inside these networks
•
If the device is exposed to the public Internet, it has to allow
an arbitrary TCP connection to the attacker, or the attacker has to spoof an
allowed TCP, connection to be vulnerable
Risk needs to be determined by the end customer and how they
have chosen to deploy the device within their environment. We make this
determination based on the following criteria:
•
Most customers have deployed devices within a network that is
not reachable from the Internet.
•
Most customers that have deployed devices connected to the public
Internet have the public connections locked down, and do not advertise the
device’s hostname or IP address.
Suggested Steps to Protect Your
Devices
To fix or mitigate devices affected by this vulnerability, we
suggest the following steps.
Mitigation Steps
Digi is currently working on firmware updates that fix these
vulnerabilities directly. Until then there are some mitigations that can be
applied to some Digi devices.
Option 1 Disable
SACK
CVE-2019-11477 SACK Panic and CVE-2019-11478 SACK Slowness:
One way to prevent the two larger attacks is to outright disable
SACK. This can only be done if your device allows root shell access, like the
IX14, EX15, and 6300 line. This can be done the following command
> echo “0” > /proc/sys/net/ipv4/tcp_sack
This fix does not persist across reboots, and so will have to be
done every time the device boots.
Option 2 Disallow
Low MSS TCP
CVE-2019-11477 SACK Panic, CVE-2019-11478 SACK Slowness and
CVE-2019-11479 Excess Resource Consumption Due to Low MSS Values:
Another way to prevent all three attacks that affect Digi
devices is to drop any TCP connections that try to connect with low MSS values,
as a low MSS value is required for all three attacks. However, this may drop
legitimate traffic. It is recommended to test this this solution before
deploying. You should also note that you might have to adjust the low range for
MSS depending on your environment.
If your device is only accessible through a firewall you can
apply a firewall rule to prevent connections with low MSS values. Sample rules
are available from Netflix here: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001/block-low-mss/README.md
If your device supports complex firewall rules, like the LR54, WR45, WR64,
IX14, EX15, and 6300 line you can block connections that have a low MSS, as a
low MSS is required for the attack.
For the LR54, WR54, and WR64 run the following commands:
> firewall -t mangle -A PREROUTING -p tcp -m conntrack
--ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
> firewall6 -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m
tcpmss ! --mss 536:65535 -j DROP
> save config
For the IX14, EX15, and 6300
line run:
> config firewall custom enable true
> config firewall custom rules "iptables -t mangle -A PREROUTING -p tcp
-m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP"
Resources
If you are interested in learning more about the disclosure,
please feel free to visit the web pages below:
•
Overall information on the
vulnerabilities https://www.kb.cert.org/vuls/id/905115/
•
SANS EDU Summary https://isc.sans.edu/diary/What+You+Need+To+Know+About+TCP+"SACK+Panic"/25046
•
Digi Security information - https://www.digi.com/resources/security
•
Researcher Information - https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md
•
Public information on CVE - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20162
If you have any other questions regarding this vulnerability and
how it affects Digi hardware products, feel free to contact us at +1 (952)
912-3456, or via the web site at www.digi.com/support. If you
have specific questions on the security analysis and/or technical aspects of
this note, you can also feel free to contact [email protected]
Last updated:
Jul 09, 2019