Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-5599: FreeBSD 12.0 may become unresponsive due to network load

CVE-2019-5599 · published 7 years ago

Summary

The problem exists in FreeBSD 12.0‑STABLE before revision r349197 and in the 12.0 release before patch level 6. An attacker who sends specially crafted network traffic can make the system waste CPU on each packet, eventually using up resources and stopping the server. Update FreeBSD to the latest version or turn off the optional RACK network feature until the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
freebsd	freebsd	12.0 `cpe:2.3:o:freebsd:freebsd:12.0:-::::::`

Original advisory text

In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service.

References

http://packetstormsecurity.com/files/153329/Linux-FreeBSD-TCP-Based-Denial-Of-Se... Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/153378/FreeBSD-Security-Advisory-FreeBSD-SA... Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2019/06/17/5 Mailing List Third Party Advisory
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party... Mitigation Third Party Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193 Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/27 Mailing List Mitigation Patch Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:08.rack.asc Mitigation Vendor Advisory
https://security.netapp.com/advisory/ntap-20190625-0004/ Third Party Advisory
https://support.f5.com/csp/article/K75521003 Third Party Advisory
https://www.kb.cert.org/vuls/id/905115 Third Party Advisory US Government Resource

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

5% chance of attack within 30 days

Type

CWE-770Allocation of Resources Without Limits

Timeline

Published2 Jul 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-5599 · NVD

Track software like this

Free during beta