# RFC 5961 TCP ACK vulnerability **URL:** \ **Category:** SLES Networking\ **Created:** [August 11, 2016, 7:12pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522 "2016-08-11T19:12:51Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![pasiit](https://avatars.discourse-cdn.com/v4/letter/p/8baadc/32.png) [@pasiit](https://forums.suse.com/u/pasiit)\ **Post date:** [August 11, 2016, 7:12pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/1 "2016-08-11T19:12:51Z")
[This bug](http://www.theregister.co.uk/2016/08/10/linux_tor_users_open_corrupted_communications/) was just public today. I have several machines running SUSE Linux Enterprise Server from version 10 to 12 SP1. How can I tell if any of these SLES are having the RFC 5961? Thank you, ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [August 11, 2016, 7:50pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/2 "2016-08-11T19:50:55Z")
Based on the dates, probably vulnerable since 2012 was long ago and SLES 12 came out since then. With that in mind, have you tried the configuration change to fix this? ```auto echo 'net.ipv4.tcp_challenge_ack_limit = 999999999' >> /etc/sysctl.conf; sysctl -p ``` I’m having a hard time finding the CVE for this for some reason, but if there is one then searching on SUSE’s site for CVE information is pretty easy from the list of all of them ever: [https://www.suse.com/security/cve/](https://www.suse.com/security/cve/) – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below… ---
**Author:** ![smflood](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/smflood/32/10576_2.png) [@smflood](https://forums.suse.com/u/smflood)\ **Post date:** [August 11, 2016, 7:55pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/3 "2016-08-11T19:55:39Z")
On 11/08/16 17:14, pasiit wrote: [color=blue] > ‘This bug’ > ([http://www.theregister.co.uk/2016/08/10/linux\_tor\_users\_open\_corrupted\_communications/](http://www.theregister.co.uk/2016/08/10/linux_tor_users_open_corrupted_communications/)) > was just public today. > I have several machines running SUSE Linux Enterprise Server from > version 10 to 12 SP1. > How can I tell if any of these SLES are having the RFC 5961?[/color] From the bug report attached to [https://www.suse.com/security/cve/CVE-2016-5696.html](https://www.suse.com/security/cve/CVE-2016-5696.html) it looks like this might affect SLE12 kernels with a feature backported for SLE11 SP3 and SP4 (but you’ll need Long Term Service Pack Support for any patches released for SLE11 SP3). Note that if you’re concerned about security you should have already upgraded/migrated servers running old, unsupported versions of SLES to current releases SLES11 SP4 or SLES12 SP1. ## HTH. Simon SUSE Knowledge Partner * * * ## If you find this post helpful and are logged into the web interface, please show your appreciation and click on the star below. Thanks. ---
**Author:** ![pasiit](https://avatars.discourse-cdn.com/v4/letter/p/8baadc/32.png) [@pasiit](https://forums.suse.com/u/pasiit)\ **Post date:** [August 11, 2016, 8:40pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/4 "2016-08-11T20:40:45Z")
> [@ab;33916](#): > > Based on the dates, probably vulnerable since 2012 No this vulnerable was just announced today. ---
**Author:** ![pasiit](https://avatars.discourse-cdn.com/v4/letter/p/8baadc/32.png) [@pasiit](https://forums.suse.com/u/pasiit)\ **Post date:** [August 11, 2016, 8:45pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/5 "2016-08-11T20:45:58Z")
[QUOTE] From the bug report attached to [https://www.suse.com/security/cve/CVE-2016-5696.html](https://www.suse.com/security/cve/CVE-2016-5696.html) it looks like this might affect SLE12 kernels with a feature backported for SLE11 SP3 and SP4 (but you’ll need Long Term Service Pack Support for any patches released for SLE11 SP3).[/QUOTE] Hi Simon, Thank you for responding. Your provided CVE does not mention anything about the vulnerability with the RFC 5961. I can’t understand how you can determine that this RFC5961 vulnerability affect all SLES? Best regards, ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [August 11, 2016, 9:25pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/6 "2016-08-11T21:25:58Z")
The bug linked to that CVE is for this issue, so SUSE is working on the issue as Bug# 989152. See the public comments here: [https://bugzilla.suse.com/show\_bug.cgi?id=989152](https://bugzilla.suse.com/show_bug.cgi?id=989152) Of particular interest: …Therefore SLE11-SP3-LTSS, SLE11-SP4 and newer kernels (except master/stable which already have the fix via 4.7) need commit 75ff39ccc1bd. – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below… ---
**Author:** ![smflood](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/smflood/32/10576_2.png) [@smflood](https://forums.suse.com/u/smflood)\ **Post date:** [August 12, 2016, 12:35pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/7 "2016-08-12T12:35:31Z")
On 11/08/16 18:54, pasiit wrote: [color=blue] > Thank you for responding. > Your provided CVE does not mention anything about the vulnerability with > the RFC 5961.[/color] [http://lmgtfy.com/?q=rfc+5961+cve](http://lmgtfy.com/?q=rfc+5961+cve) That gave me CVE-2016-5696 so I then hit SUSE’s security pages. [color=blue] > I can’t understand how you can determine that this RFC5961 vulnerability > affect all SLES?[/color] As ab said, from the publicly viewable comments of bug 989152 linked to the SUSE CVE page, specifically comment 3[1]. HTH. ## [1] [https://bugzilla.suse.com/show\_bug.cgi?id=989152#c3](https://bugzilla.suse.com/show_bug.cgi?id=989152#c3) Simon SUSE Knowledge Partner * * * ## If you find this post helpful and are logged into the web interface, please show your appreciation and click on the star below. Thanks. ---
**Author:** ![pasiit](https://avatars.discourse-cdn.com/v4/letter/p/8baadc/32.png) [@pasiit](https://forums.suse.com/u/pasiit)\ **Post date:** [August 12, 2016, 5:05pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/8 "2016-08-12T17:05:06Z")
> [@](#): > > [1] [https://bugzilla.suse.com/show\_bug.cgi?id=989152#c3](https://bugzilla.suse.com/show_bug.cgi?id=989152#c3) That bug post Michal said: “need commit 75ff39ccc1bd”. What is 75ff39ccc1bd? Thank you, ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [August 12, 2016, 6:04pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/9 "2016-08-12T18:04:26Z")
On 08/12/2016 08:14 AM, pasiit wrote:[color=blue] > [color=green] > > > [1] [https://bugzilla.suse.com/show\_bug.cgi?id=989152#c3](https://bugzilla.suse.com/show_bug.cgi?id=989152#c3) > > [/color] > > That bug post Michal said: “need commit 75ff39ccc1bd”. > What is 75ff39ccc1bd?[/color] Commits in git (and possibly other distributed version control systems) are identified by a hash of their contents, which are represented by the minimum amount needed to uniquely identify hem; in this case, the commit (probably to the kernel since I assume that is where this RFC was implemented as part of the TCP/IP stack) identifier is that string. You should not need to worry about that; if you want to know if your installed kernel has a fix, search for the CVE number or the Bug# in the kernel’s package metadata; for example: ```auto rpm -q --changelog kernel-default | less ``` Search through and you should see several notes about bug fixes, and eventually the one above. You could also, if really motivated, pull down the ‘kernel-source’ package and search through it for the fix as shown in other bug comments (bleh). It looks like the ‘net/ipv4/tcp\_input.c’ and Documentation/networking/ip-sysctl.txt files were updated/created, in particular changing sysctl\_tcp\_challenge\_ack\_limit from 100 to 1000 by default, along with some other code changes you can see. – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below… ---
**Author:** ![pasiit](https://avatars.discourse-cdn.com/v4/letter/p/8baadc/32.png) [@pasiit](https://forums.suse.com/u/pasiit)\ **Post date:** [August 12, 2016, 7:03pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/10 "2016-08-12T19:03:12Z")
> [@](#): > > ```auto > rpm -q --changelog kernel-default | less > ``` I found out that my SLES10 machines don’t have the file /proc/sys/net/ipv4/tcp\_challenge\_ack\_limit. Base on some reading, this’s mean the machines don’e have the RFC5961. Therefore, these machines are not affected. I did a `rpm -q --changelog kernel-default | grep 75ff39ccc1bd` on the affected machines (SLES11 → 12) and nothing come up. Does this mean these machines are not patched for this vulnerable? Does the command `sysctl -p` affect any thing on the running system (such as, restart service, stop something temporally)? Thank you, ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [August 12, 2016, 10:11pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/11 "2016-08-12T22:11:03Z")
On 08/12/2016 10:04 AM, pasiit wrote:[color=blue] > I found out that my SLES10 machines don’t have the file > /proc/sys/net/ipv4/tcp\_challenge\_ack\_limit. > Base on some reading, this’s mean the machines don’e have the RFC5961. > Therefore, these machines are not affected.[/color] Yes, probably too old to have this issue because it’s old enough to still have a lot of other issues. You really should patch, but I know sometimes that is easier said than done. [color=blue] > ## I did a Code: > > ``` > rpm -q --changelog kernel-default | grep 75ff39ccc1bd > > ``` > > * * * > > on the affected machines (SLES11 → 12) and nothing come up. > Does this mean these machines are not patched for this vulnerable?[/color] I think you should look for the BugZilla number, or the CVE number, rather than the commit itself, as you’re probably much more-likely to find those in there. The Bug# from [suse.com](http://suse.com) will be prefixed by ‘bsc#’ which is a good indicator. [color=blue] > ## Does the command Code: > > ``` > sysctl -p > > ``` > > * * * > > affect any thing on the running system (such as, restart service, stop > something temporally)?[/color] The ‘sysctl -p’ command loads settings from the sysctl.conf file in case they are not set. Yes, it will impact the system right away, and no you probably will not notice, other than by having settings you tried to change actually change. – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below… ---
**Author:** ![pasiit](https://avatars.discourse-cdn.com/v4/letter/p/8baadc/32.png) [@pasiit](https://forums.suse.com/u/pasiit)\ **Post date:** [October 4, 2016, 8:02pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/12 "2016-10-04T20:02:32Z")
[QUOTE=pasiit;33914][This bug](http://www.theregister.co.uk/2016/08/10/linux_tor_users_open_corrupted_communications/) was just public today. I have several machines running SUSE Linux Enterprise Server from version 10 to 12 SP1. How can I tell if any of these SLES are having the RFC 5961? Thank you,[/QUOTE] check if your system is affect by running command “cat /proc/sys/net/ipv4/tcp\_challenge\_ack\_limit”. If the file is there and the value is 100 or less. Then follow the workaround to fix the vulnerable. 1. Open the config file with: sudoedit /etc/sysctl.conf 2. Insert the line net.ipv4.tcp\_challenge\_ack\_limit = 999999999 into the file and save it 3. Run sudo sysctl -p to update the configuration ---
**Author:** ![smflood](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/smflood/32/10576_2.png) [@smflood](https://forums.suse.com/u/smflood)\ **Post date:** [October 5, 2016, 12:21pm UTC](https://forums.suse.com/t/rfc-5961-tcp-ack-vulnerability/28522/13 "2016-10-05T12:21:17Z")
On 04/10/16 18:04, pasiit wrote: [color=blue] > check if your system is affect by running command “cat > /proc/sys/net/ipv4/tcp\_challenge\_ack\_limit”. > If the file is there and the value is 100 or less. Then follow the > workaround to fix the vulnerable. > > 1. Open the config file with: sudoedit /etc/sysctl.conf > 2. Insert the line net.ipv4.tcp\_challenge\_ack\_limit = 999999999 into the > file and save it > 3. Run sudo sysctl -p to update the configuration[/color] As noted at [https://www.suse.com/security/cve/CVE-2016-5696.html](https://www.suse.com/security/cve/CVE-2016-5696.html) (which I posted earlier in this thread) SUSE have now released updated packages for some currently supported versions of SUSE products affected by this issue with more in QA. ## HTH. Simon SUSE Knowledge Partner * * * ## If you find this post helpful and are logged into the web interface, please show your appreciation and click on the star below. Thanks.