Re: Help to detect CVE-2019-11479

Matt,


Thanks for the reply.That works!


------------------


Zer0d0y
Threat Detection & Hunting






------------------ Original ------------------
From:  "Matt Trostel";<[email protected]>;
Send time: Tuesday, Jul 2, 2019 7:47 AM
To: "Zer0d0y"<[email protected]>; 
Cc: "zeek"<[email protected]>; 
Subject:  Re: [Zeek] Help to detect CVE-2019-11479



It just dawned on me. I did this for CVE-2019-11477 the other day. The below should add “mss” and “sack_ok” fields to your CONN log for all TCP connections.I’m not great at Zeek scripting, so take this with some caution. I’m sure there are folks here on the list that could better optimize this. :)






	redef record Conn::Info += {
		mss: count &optional &log;
		sack_ok: bool &optional &log;
	};
	
	redef record connection += {
		mss: count &optional &log;
		sack_ok: bool &optiional &log;
	};


	event connection_SYN_packet(c: connection, pkt: SYN_packet) {
		c$mss = pkt$MSS;
		c$sack_ok = pkt$SACK_OK;
	}


	event connection_state_remove(c: connection) {
		if ( c ?$ mss )
			c$conn$mss = c$mss;


		if (c ?$ sack_ok )
			c$conn$sack_ok = c$sack_ok;
	}





On Jul 1, 2019, at 18:33, Matt Trostel <[email protected]> wrote:

Hi Zer0d0y,

You should be able to pull these values from the connection_SYN_packet event (https://docs.zeek.org/en/stable/script-reference/proto-analyzers.html#id-connection_SYN_packet).


The SYN packet (https://docs.zeek.org/en/stable/scripts/base/init-bare.bro.html#type-SYN_packet) contains the MSS value.


I hope this helps.


- Matt


On Jul 1, 2019, at 10:19, Zer0d0y <[email protected]> wrote:

Hi all,
    Recently,Netflix has identified several TCP networking vulnerabilities in FreeBSD and Linux kernels. (#CVE-2019-11479 : Excess Resource Consumption Due to Low MSS Values (all Linux versions) 


    We want to detecting this flaw with Zeek,but looks like there's no way to get the MSS(Maximum segment size) value of TCP Option,any ideas?


Thanks,


------------------


Zer0d0y
Threat Detection & Hunting


_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek