HIGH
net UDP Checksum DoS
CVE-2015-5364
AV:N/AC:L/Au:N/C:N/I:N/A:C
KernelScan AI7.8HIGH
01Description
The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.
02KernelScan AI Analysis
Risk summary
A Linux host with an active UDP receiver can be hung by an unauthenticated remote sender flooding it with packets that have invalid checksums. Vulnerable receive processing can repeatedly discard that traffic while competing work receives little or no processor time, causing an availability-only denial of service in both IPv4 and IPv6.
Vulnerability analysis
When invalid-checksum UDP datagrams are discarded, a receive path can keep cycling through a queue that an attacker continually replenishes. Vulnerable kernels can also report temporary unavailability to a nonblocking receiver even while packets remain queued, and the processing path may restart without giving other tasks a scheduling opportunity; under a sustained flood this can starve the system, particularly on a uniprocessor host. The fix makes both IPv4 and IPv6 receive processing offer a rescheduling point before retrying and continue handling queued traffic instead of returning early. An unauthenticated remote sender with network reachability to an active UDP socket can trigger the condition by sending many packets with incorrect checksums; no local access, account, special privilege, or special hardware is required, while IPv6 reachability also depends on IPv6 being enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 3.10 | — | 3.10.81 | a3cfde2a311c |
| 4.0 | — | 4.0.6 | — |
| mainline | — | 4.1-rc7 | beb39db59d14 |