Product
Solaris 9 Operating System
Solaris 10 Operating System
Solaris 8 Operating System

Bug Id
4511681

Date of Resolved Release
26-JUL-2006

Impact

A remote privileged user may create a TCP (tcp(7p)) "ACK storm" or "ACK flood" which can cause a networked system to run out of resources, creating a Denial of Service (DoS) condition.

A TCP "ACK storm" can occur when a networked system sends a TCP packet which contains an incorrect sequence number to another networked system. The remote system will reply with a TCP ACK packet containing the expected sequence number and the originating system will send another packet with the incorrect sequence number. This exchange of ACK packets will continue indefinitely back and forth and thus create an "ACK storm".

This is the expected behavior of the Internet Transmission Control Protocol (TCP) protocol. The TCP protocol specification is described in RFC 793 at:

• http://www.ietf.org/rfc/rfc0793.txt

The patches listed in Section Two below limit the number of replies a Solaris system will make to a TCP packet with an incorrect sequence number and thus protect against an "ACK storm".

Contributing Factors

This issue can occur in the following releases:

SPARC Platform

• Solaris 8 without patch 116965-17
• Solaris 9 without patch 118305-07
• Solaris 10 without patch 118833-12

x86 Platform

• Solaris 8 without patch 116966-16
• Solaris 9 without patch 117470-06
• Solaris 10 without patch 118855-10

Symptoms

The system's performance will slow down if the described issue occurs, however, other systems on the network will not be affected.

The snoop output will be similar to the following:

    -----------------------------------------------------------------------------------------
    5   0.00000 192.168.1.245 -> 192.168.1.58  TCP D=3071 S=8080 Fin Ack=2363033 Seq=1558809380 Len=990 Win=8760
    6   0.00000 192.168.1.245 -> 192.168.1.58  TCP D=3071 S=8080     Ack=2363033 Seq=1558809380 Len=0 Win=8760
    7   0.00000  192.168.1.58 -> 192.168.1.245 TCP D=8080 S=3071     Ack=1558810371 Seq=2363033 Len=0 Win=7770
    8   0.00000 192.168.1.245 -> 192.168.1.58  TCP D=3071 S=8080     Ack=2363033 Seq=1558809380 Len=0 Win=8760
    9   0.00000  192.168.1.58 -> 192.168.1.245 TCP D=8080 S=3071     Ack=1558810371 Seq=2363033 Len=0 Win=7770
    10   0.01000 192.168.1.245 -> 192.168.1.58  TCP D=3071 S=8080     Ack=2363033 Seq=1558809380 Len=0 Win=8760
    11   0.00000  192.168.1.58 -> 192.168.1.245 TCP D=8080 S=3071 Fin Ack=1558810371 Seq=2363033 Len=0 Win=7770
    12   0.00000  192.168.1.58 -> 192.168.1.245 TCP D=8080 S=3071     Ack=1558810371 Seq=2363034 Len=0 Win=7770
    13   0.00000 192.168.1.245 -> 192.168.1.58  TCP D=3071 S=8080     Ack=2363033 Seq=1558809380 Len=0 Win=8760

    -----------------------------------------------------------------------------------------

The systems performance will slow down if the described issue occurs, however, it will not effect other systems in the network.

Workaround

There is no workaround. Please see the "Resolution" section below.

Resolution

This issue is addressed in the following releases:

SPARC Platform

• Solaris 8 with patch 116965-17 or later
• Solaris 9 with patch 118305-07 or later
• Solaris 10 with patch 118833-12 or later

x86 Platform

• Solaris 8 with patch 116966-16 or later
• Solaris 9 with patch 117470-06 or later
• Solaris 10 with patch 118855-10 or later

References

117470-06
116965-17
116966-16
118305-07
118855-10
118833-12




Attachments

This solution has no attachment