NetBSD up to 5.1.5/5.2.3/6.0.6/6.1.5 LAST_ACK State Transition resource management

Summaryinfo

A vulnerability, which was classified as problematic, has been found in NetBSD up to 5.1.5/5.2.3/6.0.6/6.1.5. The impacted element is an unknown function of the component LAST_ACK State Transition Handler. Performing a manipulation results in resource management. This vulnerability was named CVE-2015-5358. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as problematic has been found in NetBSD up to 5.1.5/5.2.3/6.0.6/6.1.5 (Operating System). This affects an unknown functionality of the component LAST_ACK State Transition Handler. The manipulation with an unknown input leads to a resource management vulnerability. CWE is classifying the issue as CWE-399. This is going to have an impact on availability.

The weakness was presented 10/22/2015 as NetBSD Security Advisory 2015-009 as confirmed advisory (Website). It is possible to read the advisory at ftp.NetBSD.org. This vulnerability is uniquely identified as CVE-2015-5358 since 07/01/2015. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The advisory points out:

When closing a connection the TCP socket is entering the LAST_ACK state in which kernel waits for acknowledgement that FIN was delivered to the peer or failure of all packet retransmission. In certain circumstances a socket in this state may hold a significant amount of memory (mbufs) which can be held for indefinite time, because the "persist" timer responsible for cleaning up that memory was previously deactivated. If an attacker is able to make the attacked systems sockets enter that state, then remote denial of service is possible due to memory exhaustion.

The vulnerability scanner Nessus provides a plugin with the ID 85226 (Juniper Junos LAST_ACK State DoS (JSA10686)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Junos Local Security Checks.

Applying a patch is able to eliminate this problem. A possible mitigation has been published before and not just after the disclosure of the vulnerability. The advisory contains the following remark:

For all NetBSD versions, if you want to upgrade to a safe kernel from source, you need to obtain fixed kernel sources, rebuild and install the new kernel, and reboot the system. The fixed source may be obtained from the NetBSD CVS repository. The following instructions briefly summarise how to upgrade your kernel.

The vulnerability is also documented in the databases at Tenable (85226) and SecurityTracker (ID 1033915†). See VDB-76401 and VDB-76796 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Name

• NetBSD

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion