HIGH
net IPv4 Reassembly DoS
CVE-2018-5391
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.
02KernelScan AI Analysis
Risk summary
An unauthenticated remote attacker able to deliver IPv4 traffic can send a low-rate sequence of overlapping fragments that overconsumes fragment-reassembly resources and causes denial of service. Internet-, LAN-, and VPN-reachable systems are at risk, including shared container hosts, and no account or elevated privilege is required.
Vulnerability analysis
The original IPv4 fragment reassembly logic accepted overlapping byte ranges and attempted to trim and reconcile them against queued fragments. A specially arranged sequence could therefore force excessive processing and retain enough reassembly state to exhaust resources, particularly when larger queue limits are permitted. The fix detects any overlap and discards the entire affected datagram and its queued fragments instead of attempting to merge them. A remote sender can trigger this path by delivering crafted IPv4 fragments to the target over a reachable network without an account, privilege, local access, or special hardware.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | — | 4.19 | 7969e5c40dfd |
| cip/4.4 | — | 4.4.176-cip31 | ef0f963de1d2 |
| cip/4.4-rt | — | 4.4.176-cip31-rt23 | ef0f963de1d2 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/4.4 | Fixed in 4.4.176-cip31 |
| cip/4.4-rt | Fixed in 4.4.176-cip31-rt23 |