3

A new security vulnerability has been announced called "TCP SACK PANIC". https://access.redhat.com/security/vulnerabilities/tcpsack

Three related flaws were found in the Linux kernel’s handling of TCP networking. The most severe vulnerability could allow a remote attacker to trigger a kernel panic in systems running the affected software and, as a result, impact the system’s availability.

A work around suggested by theregister.co.uk is to disable TCP SACK.

https://www.theregister.co.uk/2019/06/17/linux_tcp_sack_kernel_crash/

Patches and mitigations are available, and can be applied by hand if needed, or you can wait for a security fix to be pushed or offered to your at-risk device. A key workaround is to set /proc/sys/net/ipv4/tcp_sack to 0.

How do you do this on CentOS 7.6.1810?

I've tried using sudo nano and editing the file to 0, but I don't have permission, I tried changing the permissions to get write access and that also returned changing permissions of 'tcp_sack': Operation not permitted.

Improve this question
2
  • I realise that this may be better suited to serverfault.com
    – HippoDuck
    Jun 18, 2019 at 11:16
  • SELinux? Shared kernel virtualization?
    – Kamil Maciorowski
    Jun 18, 2019 at 11:42

1 Answer 1

Reset to default
5

You should be able to do

echo "0" > /proc/sys/net/ipv4/tcp_sack

Make sure to do this as a superuser, regular system users do not have permission to alter this value.

This change is not parmanent by the way, add the following to your /etc/sysctl.conf to apply it on boot and you can use sysctl -p to directly apply the changes:

echo "net.ipv4.tcp_sack = 0" >> /etc/sysctl.conf
sysctl -p
Improve this answer
6
  • 1
    I set sudo su first, and then tried both but still getting sysctl: permission denied on key 'net.ipv4.tcp_sack'
    – HippoDuck
    Jun 18, 2019 at 11:18
  • @user2924019 If you're root it will work. Permission denied is to be expected if you do sudo with a redirect.
    – Nick
    Jun 25, 2019 at 9:23
  • I tried with root with and without sudo.
    – HippoDuck
    Jun 25, 2019 at 12:10
  • 1
    The issue is that the >> happens in the user's shell, not the sudo shell. Do something like sudo bash then do the echo.
    – stolenmoment
    Jun 25, 2019 at 15:10
  • Is a reboot required?
    – PeterJ
    Jun 27, 2019 at 1:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .