Jonathan Looney

The issue is related to insufficient input validation in the JSSE component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This can be exploited by an unauthenticated attacker with network access via HTTPS, potentially leading to a hang or frequently repeatable crash of the system. The vulnerability applies to Java deployments that load and run untrusted code, relying on the Java sandbox for security. It can also be exploited through APIs in the specified component, for example, via a web service supplying data to the APIs.

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST STREAM frames from the peer. Depending on how the peer queues the RST STREAM frames, this can consume excess memory, CPU, or both. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes.

Some HTTP/2 implementations are vulnerable to ping floods and reset floods, potentially leading to a denial of service. An attacker can send continual pings or invalid requests to an HTTP/2 peer, causing the peer to build an internal queue of responses or RST STREAM frames. This can consume excess CPU, memory, or both, potentially leading to a crash. The vulnerability can be exploited by a remote attacker, allowing them to cause a denial of service.

The issue is related to a denial of service vulnerability in some HTTP/2 implementations. An attacker can create multiple request streams and continually shuffle the priority of the streams, causing substantial churn to the priority tree and consuming excess CPU. This can lead to a denial of service. The vulnerability is associated with uncontrolled resource consumption and can be exploited by a remote attacker.

The issue is related to an uncontrolled resource consumption when receiving a header with a length parameter set to zero in HTTP/2 implementations. This can lead to a denial of service. An attacker can exploit this by sending a stream of headers with 0-length header names and 0-length header values, which can cause excess memory consumption as some implementations allocate memory for these headers and keep it alive until the session ends.

The issue is related to errors in the resource consumption control mechanism of the HTTP/2 protocol implementation in various software products. An attacker can exploit this by sending a stream of SETTINGS frames, potentially leading to a denial of service due to excessive CPU or memory consumption. The vulnerability can be exploited by continually sending data, causing affected components to consume large amounts of memory and potentially leading to an out-of-memory condition.

The issue is related to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service by sending a specially crafted sequence of SACK packets. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited. The vulnerability is related to the `TCP SKB CB(skb)->tcp gso segs` value.

The issue is related to the TCP retransmission queue implementation in the Linux kernel when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could exploit this to cause a denial of service by sending a specially crafted sequence of SACK packets, leading to resource exhaustion.

The issue is related to window size manipulation and stream prioritization manipulation in HTTP/2 implementations, potentially leading to a denial of service. An attacker can request a large amount of data from a specified resource over multiple streams, manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. This can consume excess CPU, memory, or both, depending on how efficiently the data is queued.

The issue is related to errors in the mechanism controlling resource expenditure in HTTP/2 implementations, potentially leading to a denial of service. An attacker can exploit this by opening the HTTP/2 window, allowing the peer to send without constraint, while keeping the TCP window closed, preventing the peer from writing bytes on the wire. The attacker then sends a stream of requests for a large response object, which can consume excess memory, CPU, or both, depending on how servers queue responses.

The issue is caused by the Linux kernel's default Maximum Segment Size (MSS) being hard-coded to 48 bytes, allowing a remote peer to fragment TCP resend queues more significantly than if a larger MSS were enforced. This can be exploited by a remote attacker to cause a denial of service by sending a specially crafted sequence of TCP packets.

The issue is related to the improper validation of TCP packet headers, which can be exploited by remote attackers to disrupt TCP connections, causing a denial of service. This is achieved by sending a crafted TCP packet header. The estimated number of potentially affected devices is not specified.

The issue allows remote attackers to cause a denial of service by consuming mbuf and connections, leading to a restart, via a large number of requests that trigger a TCP connection to move to the LAST ACK state when there is more data to send.