FreeBSD -- Infinite loop in SACK handling

Problem description:

When insufficient memory is available to handle an incoming selective acknowledgement, the TCP/IP stack may enter an infinite loop.

Impact:

By opening a TCP connection and sending a carefully crafted series of packets, an attacker may be able to cause a denial of service.

Workaround:

On FreeBSD 5.4, the net.inet.tcp.sack.enable sysctl can be used to disable the use of SACK:

# sysctl net.inet.tcp.sack.enable=0

No workaround is available for FreeBSD 5.3.