Lucene search

K
certCERTVU:641765
HistoryAug 14, 2018 - 12:00 a.m.

Linux kernel IP fragment re-assembly vulnerable to denial of service

2018-08-1400:00:00
www.kb.cert.org
789

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.019 Low

EPSS

Percentile

88.1%

Overview

The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packets.

Description

CWE-400: Uncontrolled Resource Consumption (‘Resource Exhaustion’) - CVE-2018-5391

The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly.

An attacker may cause a denial of service condition by sending specially crafted IP fragments.

Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.


Impact

An attacker may be able to trigger a denial-of-service condition against the system.


Solution

Apply a patch
Patches are available from OS vendors to address the vulnerability.


If you are unable to apply a patch, see the following mitigations:

Modify Default Configurations
Change the (default) values of net.ipv4/ipv6.ipfrag_high_thresh and net.ipv4/ipv6.ipfrag_low_thresh back to 256kB and 192 kB (respectively) or below.

Example:
sysctl -w net.ipv4.ipfrag_low_thresh=196608 sysctl -w net.ipv4.ipfrag_high_thresh=262144 sysctl -w net.ipv6.ip6frag_low_thresh=196608 sysctl -w net.ipv6.ip6frag_high_thresh=262144

Update:
Further testing shows that these mitigations are not a 100% fix. A significantly strong attack will still result in a denial of service condition.

Revert Commit
Another sufficient mitigation is to revert the commit c2a936600f78aea00d3312ea4b66a79a4619f9b4


Vendor Information

641765

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Arista Networks, Inc. Affected

Notified: August 13, 2018 Updated: August 15, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Check Point Software Technologies __ Affected

Notified: August 13, 2018 Updated: September 13, 2018

Statement Date: September 13, 2018

Status

Affected

Vendor Statement

Check Point is Affected by both FragmentSmack and SegmentSmack

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Debian GNU/Linux Affected

Notified: August 13, 2018 Updated: August 15, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Microsoft __ Affected

Notified: August 13, 2018 Updated: October 12, 2018

Status

Affected

Vendor Statement

Microsoft is aware of a denial of service vulnerability (named “FragmentSmack” CVE-2018-5391) affecting Windows systems. An attacker could send many 8-byte sized IP fragments with random starting offsets, but withhold the last fragment and exploit the worst-case complexity of linked lists in reassembling IP fragments. A system under attack would become unresponsive with 100% CPU utilization but would recover as soon as the attack terminated.

To protect your system from this vulnerability, Microsoft recommends that you take the following actions:

  1. Register for security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.
  2. Test and apply security updates. See the Affected Products table to download and install the updates.
  3. If you cannot apply the security updates immediately, you can apply the workaround described in FAQ #1.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Red Hat, Inc. Affected

Notified: August 13, 2018 Updated: August 15, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

SUSE Linux __ Affected

Notified: August 13, 2018 Updated: September 12, 2018

Statement Date: August 15, 2018

Status

Affected

Vendor Statement

SUSE is affected by this problem in its SUSE Linux Enterprise 12 and 15 series kernels,

and will be providing updates.

<https://www.suse.com/security/cve/CVE-2018-5391&gt;

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Ubuntu Affected

Notified: August 13, 2018 Updated: August 15, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Broadcom __ Not Affected

Notified: August 13, 2018 Updated: September 11, 2018

Statement Date: August 23, 2018

Status

Not Affected

Vendor Statement

Advisory for CVE-2018-539: <https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-690&gt;

Vendor References

3com Inc Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

A10 Networks Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

ACCESS Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

ADTRAN Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

ANTlabs Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

ARRIS Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

ASP Linux Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

AT&T Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

AVM GmbH Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Actelis Networks Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Actiontec Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Aerohive Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

AhnLab Inc Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

AirWatch Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Akamai Technologies, Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Alcatel-Lucent Enterprise Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Alpine Linux Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Amazon Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Android Open Source Project Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Appgate Network Security Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Apple Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Arch Linux Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Aruba Networks Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

AsusTek Computer Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Atheros Communications Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Avaya, Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Barracuda Networks Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Belkin, Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Bell Canada Enterprises Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

BlackBerry Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

BlueCat Networks, Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Brocade Communication Systems Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CA Technologies Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Cambium Networks Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Ceragon Networks Inc Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Cisco Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Comcast Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Command Software Systems Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CoreOS Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Cradlepoint Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

D-Link Systems, Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Dell Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Dell EMC Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Dell SecureWorks Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

DesktopBSD Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Deutsche Telekom Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Devicescape Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Digi International Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

DragonFly BSD Project Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

EfficientIP SAS Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Ericsson Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Espressif Systems Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

European Registry for Internet Domains Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Express Logic Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Extreme Networks Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

F-Secure Corporation Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

F5 Networks, Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Fedora Project Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Force10 Networks Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Foundry Brocade Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

FreeBSD Project Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

GNU glibc Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Geexbox Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Gentoo Linux Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Google Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

HP Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

HTC Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

HardenedBSD Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Hitachi Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Honeywell Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Huawei Technologies Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

IBM Corporation (zseries) Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

IBM, INC. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

InfoExpress, Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Infoblox Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Intel Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Internet Systems Consortium Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Internet Systems Consortium - DHCP Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Interniche Technologies, inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Joyent Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Juniper Networks Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Kyocera Communications Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Lancope Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Lantronix Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Lenovo Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Linksys Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Marvell Semiconductors Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

McAfee Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

MediaTek Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Medtronic Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Men & Mice Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

MetaSwitch Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Micro Focus Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Microchip Technology Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

MikroTik Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Miredo Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Mitel Networks, Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

NEC Corporation Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

NETSCOUT Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

NLnet Labs Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

NetBSD Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Netgear, Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Nixu Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Nokia Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Nominum Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

OmniTI Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

OpenBSD Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

OpenConnect Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

OpenDNS Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Openwall GNU/*/Linux Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Oracle Corporation Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Paessler Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Peplink Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Philips Electronics Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

PowerDNS Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Pulse Secure Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

QLogic Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

QNX Software Systems Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

QUALCOMM Incorporated Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Quagga Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Quantenna Communications Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Riverbed Technologies Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Roku Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Ruckus Wireless Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Samsung Mobile Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Samsung Semiconductor Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Secure64 Software Corporation Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Sierra Wireless Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Slackware Linux Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Snort Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

SonicWall Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Sonos Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Sony Corporation Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Sophos, Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Sourcefire Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Symantec Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Synology Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

TP-LINK Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Technicolor Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

TippingPoint Technologies Inc. Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Toshiba Commerce Solutions Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

TrueOS Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Turbolinux Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Ubiquiti Networks Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Unisys Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

VMware Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Wind River Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Xilinx Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Zebra Technologies Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Zephyr Project Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Zyxel Unknown

Notified: August 13, 2018 Updated: August 16, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

aep NETWORKS Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

dnsmasq Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

eero Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

m0n0wall Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

netsnmp Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

pfSense Unknown

Notified: August 13, 2018 Updated: August 13, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

View all 165 vendors __View less vendors __

CVSS Metrics

Group Score Vector
Base 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C
Temporal 6.6 E:U/RL:ND/RC:ND
Environmental 6.6 CDP:ND/TD:H/CR:ND/IR:ND/AR:ND

References

<https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=c30f1fc041b74ecdb072dd44f858750414b8b19f&gt;

Acknowledgements

Thanks to Juha-Matti Tilli (Aalto University, Department of Communications and Networking / Nokia Bell Labs) for reporting this vulnerability.

This document was written by Trent Novelly.

Other Information

CVE IDs: CVE-2018-5391
Date Public: 2018-08-14 Date First Published:

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.019 Low

EPSS

Percentile

88.1%