A new security vulnerability has been announced called "TCP SACK PANIC". https://access.redhat.com/security/vulnerabilities/tcpsack
Three related flaws were found in the Linux kernel’s handling of TCP networking. The most severe vulnerability could allow a remote attacker to trigger a kernel panic in systems running the affected software and, as a result, impact the system’s availability.
A work around suggested by theregister.co.uk is to disable TCP SACK.
https://www.theregister.co.uk/2019/06/17/linux_tcp_sack_kernel_crash/
Patches and mitigations are available, and can be applied by hand if needed, or you can wait for a security fix to be pushed or offered to your at-risk device. A key workaround is to set /proc/sys/net/ipv4/tcp_sack to 0.
How do you do this on CentOS 7.6.1810?
I've tried using sudo nano
and editing the file to 0, but I don't have permission, I tried changing the permissions to get write access and that also returned changing permissions of 'tcp_sack': Operation not permitted
.