I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So a packet which is extremely out-of-order can exploit the vulnerability.

But I didn't understand what extremely out-of-order means. Does it mean I have to re-arrange the packets such that packets that are supposed to be adjacent are very far from each other? Does that simple operation make a normal stream of packets an exploit?


Basically that techniques tries to test the reordering mechanism in TCP, you can see the problem as a linked list that needs to be in order, so depending on the implementation of the TCP stack this can be a problem or not, also take into account that the IP packets that are part of this list needs to be in memory until the last TCP PUSH Packet that in general is the indicator that the segment is complete. So two problems here, the first related to the implementation of the list and the second a problem related to memory because you need to keep the packets on memory until the PUSH or close the connection happens. Hope it helps to clairfy

| improve this answer | |
  • So the the mechanism wait for TCP PUSH packet and reorders all the packets received before that, if we have a large stream without TCP push packed that is unordered that would trigger a big computation which keeps the cores busy. Am I correct? – mathworker Sep 3 '18 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.