3

A new security vulnerability has been announced called "TCP SACK PANIC". https://access.redhat.com/security/vulnerabilities/tcpsack

Three related flaws were found in the Linux kernel’s handling of TCP networking. The most severe vulnerability could allow a remote attacker to trigger a kernel panic in systems running the affected software and, as a result, impact the system’s availability.

A work around suggested by theregister.co.uk is to disable TCP SACK.

https://www.theregister.co.uk/2019/06/17/linux_tcp_sack_kernel_crash/

Patches and mitigations are available, and can be applied by hand if needed, or you can wait for a security fix to be pushed or offered to your at-risk device. A key workaround is to set /proc/sys/net/ipv4/tcp_sack to 0.

How do you do this on CentOS 7.6.1810?

I've tried using sudo nano and editing the file to 0, but I don't have permission, I tried changing the permissions to get write access and that also returned changing permissions of 'tcp_sack': Operation not permitted.

  • I realise that this may be better suited to serverfault.com – user2924019 Jun 18 at 11:16
  • SELinux? Shared kernel virtualization? – Kamil Maciorowski Jun 18 at 11:42
3

You should be able to do

echo "0" > /proc/sys/net/ipv4/tcp_sack

Make sure to do this as a superuser, regular system users do not have permission to alter this value.


This change is not parmanent by the way, add the following to your /etc/sysctl.conf to apply it on boot and you can use sysctl -p to directly apply the changes:

echo "net.ipv4.tcp_sack = 0" >> /etc/sysctl.conf
sysctl -p
  • 1
    I set sudo su first, and then tried both but still getting sysctl: permission denied on key 'net.ipv4.tcp_sack' – user2924019 Jun 18 at 11:18
  • @user2924019 If you're root it will work. Permission denied is to be expected if you do sudo with a redirect. – Nick Jun 25 at 9:23
  • I tried with root with and without sudo. – user2924019 Jun 25 at 12:10
  • The issue is that the >> happens in the user's shell, not the sudo shell. Do something like sudo bash then do the echo. – stolenmoment Jun 25 at 15:10
  • Is a reboot required? – PeterJ Jun 27 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.