Netflix Uncovers TCP Bugs Within The Linux & FreeBSD Kernels

[Azrael5]

Linux Os has to improve in security and efficiency.

[yossarianuk]

A few minutes after the announcement my PC was already running 5.1.11. Too bad it's gonna take quite some time before OpenWRT updates their images. They haven't even applied the patches yet

As a workaround you can run

sysctl net.ipv4.tcp_sack=0

My understanding is this can slow down TCP connections - you are better off using the iptables rule

iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP

Suse's advisory suggests this -> https://www.suse.com/support/kb/doc/?id=7023928

[aht0]

https://github.com/Netflix/security-...it_limit.patch
Netflix's provided patch for FreeBSD (12)

[birdie]

So they're being fixed in Linux. What about FreeBSD? Shouldn't Netflix fix it in the first place?

Default FreeBSD is not even affected.

[Volta]

So they're being fixed in Linux. What about FreeBSD? Shouldn't Netflix fix it in the first place?

[birdie]

A few minutes after the announcement my PC was already running 5.1.11. Too bad it's gonna take quite some time before OpenWRT updates their images. They haven't even applied the patches yet

As a workaround you can run

sysctl net.ipv4.tcp_sack=0

[rene]

this news is a bit latish, ..! ;-) https://www.youtube.com/watch?v=8akg0mPyflw

[phoronix]

Phoronix: Netflix Uncovers TCP Bugs Within The Linux & FreeBSD Kernels

As Netflix's first security bulletin for 2019, they warned of TCP-based remote denial of service vulnerabilities affecting both Linux and FreeBSD. These vulnerabilities are rated "critical" but already being corrected within the latest Git code...

http://www.phoronix.com/scan.php?page=news_item&px=Netflix-TCP-BSD-Linux-Bugs