Security Vulnerability: Amnesia:33

This document (000019813) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server

Situation

Security researchers from Forescout research labs have published new attacks against embedded IP stacks, which allows network attackers to potentially execute code or denial of service attacks against those IP stacks.

The Linux Kernel TCP/IP stack is not affected by these attacks.

The SUSE "open-iscsi" package uses a version of "uIP" embedded IP stack when offloading to "qedi", "bnx2" and "bnx2x" network adapters, this part is affected by a subset of the attacks.

 

Resolution

The solution is to install updates for open-iscsi once they become available.

Workaround
A potential workaround would be to remove the "iscsiuio" sub-package of open-iscsi, or disable its systemd services. This will likely however break offload functionality to "qedi" or "bnx2" and "bnx2x" cards.

Resolution
SUSE is working on fixes for open-iscsi.


 

Cause

More information can be found at:
CVE's for the sub set of attack related to open-iscsi 

Status

Security Alert

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:000019813
  • Creation Date: 15-Dec-2020
  • Modified Date:15-Dec-2020
    • SUSE Linux Enterprise Desktop
    • SUSE Linux Enterprise Server

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback@suse.com

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

Join Our Community

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.


SUSE Customer Support Quick Reference Guide SUSE Technical Support Handbook Update Advisories
Support FAQ

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.

Go to Customer Center