Security Vulnerability: Amnesia:33

This document (000019813) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server

Situation

Security researchers from Forescout research labs have published new attacks against embedded IP stacks, which allows network attackers to potentially execute code or denial of service attacks against those IP stacks.

The Linux Kernel TCP/IP stack is not affected by these attacks.

The SUSE "open-iscsi" package uses a version of "uIP" embedded IP stack when offloading to "qedi", "bnx2" and "bnx2x" network adapters, this part is affected by a subset of the attacks.

Resolution

The solution is to install updates for open-iscsi once they become available.

Workaround
A potential workaround would be to remove the "iscsiuio" sub-package of open-iscsi, or disable its systemd services. This will likely however break offload functionality to "qedi" or "bnx2" and "bnx2x" cards.

Resolution
SUSE is working on fixes for open-iscsi.

Cause

More information can be found at:

CVE's for the sub set of attack related to open-iscsi

Status

Security Alert

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.