evolix
/
ansible-roles
22
2
Fork 2
Code Issues 61 Pull Requests 18 Releases 32 Wiki Activity

Workaround by Evolix security team for old kernels and vulnerabiliy CVE-2018-5391 (FragmentSmack)

This commit is contained in:
Gregory Colpart 2018-08-17 21:28:14 +02:00
parent dbb72ef2a0
commit 51f41ff14a
1 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
evolinux-base/tasks/kernel.yml
View File

@ -50,4 +50,36 @@
reload: yes
when: evolinux_kernel_cve20165696
- name: Patch for TCP stack vulnerabiliy CVE-2018-5391 (FragmentSmack)
sysctl:
name: net.ipv4.ipfrag_low_thresh
value: 196608
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
state: present
reload: yes
- name: Patch for TCP stack vulnerabiliy CVE-2018-5391 (FragmentSmack)
sysctl:
name: net.ipv6.ip6frag_low_thresh
value: 196608
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
state: present
reload: yes
- name: Patch for TCP stack vulnerabiliy CVE-2018-5391 (FragmentSmack)
sysctl:
name: net.ipv4.ipfrag_high_thresh
value: 262144
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
state: present
reload: yes
- name: Patch for TCP stack vulnerabiliy CVE-2018-5391 (FragmentSmack)
sysctl:
name: net.ipv6.ip6frag_high_thresh
value: 262144
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
state: present
reload: yes
- meta: flush_handlers