Source: SC Magazine UK. Original advisory date: July 2, 2019.
Overview
In early July 2019, VMware instructed users to watch for software patches covering 31 of its products affected by two vulnerabilities in the Linux kernel’s implementation of TCP Selective Acknowledgement (SACK). Left unpatched, these flaws could allow a remote attacker to trigger a denial-of-service (DoS) condition against affected systems.
Background: What Are the Linux SACK Vulnerabilities?
TCP Selective Acknowledgement (SACK) is a mechanism that allows a TCP receiver to inform the sender which segments have been received out of order, enabling more efficient retransmission. Netflix researchers discovered and disclosed two serious flaws in how the Linux kernel handles SACK packets:
- SACK Panic (CVE-2019-11477) — A specially crafted sequence of SACK packets could cause the Linux kernel to panic (crash), resulting in a denial of service. This vulnerability carries a CVSSv3 base score of 7.5 (High).
- SACK Excess Resource Usage (CVE-2019-11478) — Malformed SACK blocks could cause the kernel to fragment the TCP retransmission queue excessively, consuming disproportionate CPU and memory resources. This vulnerability carries a CVSSv3 base score of 5.3 (Medium).
Both vulnerabilities were originally found and responsibly disclosed by Netflix researchers, together with two additional Linux-specific bugs disclosed at the same time.
VMware’s Assessment and Advisory
VMware published a security advisory on July 2, 2019, collectively rating the vulnerabilities as Important in severity. The advisory warned:
“These issues may allow a malicious entity to execute a denial of service attack against affected products.”
VMware Security Advisory, July 2, 2019
Because a large portion of VMware’s product portfolio runs on Linux-based appliances and virtual machines, the attack surface was broad — spanning 31 distinct products.
Products with Patches or Workarounds Available (as of July 3, 2019)
As of approximately 11:30 a.m. ET on July 3, 2019, VMware had released patches for the following products:
- SD-WAN Edge by VeloCloud
- SD-WAN Gateway by VeloCloud
- SD-WAN Orchestrator by VeloCloud
- Unified Access Gateway
- vCenter Server Appliance
Workarounds (rather than full patches) were also made available for:
- Unified Access Gateway
- vCloud Director for Service Providers
Products with Patches Pending
At the time of reporting, the following 26 products were confirmed affected but awaiting patches:
- AppDefense
- Container Service Extension
- Enterprise PKS
- Horizon
- Horizon DaaS
- Hybrid Cloud Extension
- Identity Manager
- Integrated OpenStack
- NSX for vSphere
- NSX-T Data Center
- Pulse Console
- Skyline Collector
- vCloud Availability Appliance
- vCloud Director for Service Providers
- vCloud Usage Meter
- vRealize Automation
- vRealize Business for Cloud
- vRealize Code Stream
- vRealize Log Insight
- vRealize Network Insight
- vRealize Operations Manager
- vRealize Orchestrator Appliance
- vRealize Suite Lifecycle Manager
- vSphere Data Protection
- vSphere Integrated Containers
- vSphere Replication
Recommended Actions for VMware Administrators
VMware administrators should take the following steps if they have not already applied fixes:
- Check VMware’s Security Advisories page for the latest patch availability for each affected product. Patch timelines varied per product.
- Apply available patches immediately for products where patches were released, prioritising internet-facing appliances.
- Apply workarounds where full patches were not yet available. A common Linux-level workaround for SACK vulnerabilities is to disable SACK via the kernel parameter
net.ipv4.tcp_sack=0, though this should only be applied after verifying VMware’s specific guidance for each product, as it may affect performance. - Monitor VMware’s advisory for updates as patches for pending products become available.
- Restrict network access to management interfaces where possible, reducing the exposure of vulnerable appliances to untrusted networks.
Context: Industry-Wide Impact
The Linux SACK vulnerabilities affected any system running an unpatched Linux kernel, meaning the impact extended well beyond VMware. Major Linux distributions — including Red Hat, Ubuntu, CentOS, and SUSE — issued kernel updates around the same time. Cloud providers, hypervisor vendors, and network appliance manufacturers all issued their own advisories. The breadth of VMware’s affected product list reflects how widely Linux-based appliances are used across its portfolio.
This article is based on reporting from SC Magazine UK and VMware’s July 2019 security advisory. Administrators should consult the official VMware Security Advisories portal for current patch status, as all products listed above have since received updates or reached end-of-life.