This cookbook is a useful example of basic chef functionality. Consisting of just two components, the metadata and the recipe, it is a good example for teaching core chef concepts.
The default recipe sets a sysctl variable:
net.ipv4.tcp_sack = 0
With SACK disabled, the DoS attack described in TCP SACK PANIC - Kernel vulnerabilities is mitigated.
Per usual, upload the cookbook to your chef server:
$ knife upload ./tcp_sack_fix
Then add to the run list for your Linux clients or a common role they share.
Use the sysctl utility for confirmation that the change has been applied.
$ sysctl net.ipv4.tcp_sack
net.ipv4.tcp_sack = 0