CVE-2013-4563

HighCVSS 7.1/10Last modified Jun 16, 2026

Description

The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline.

Metrics

CVSS 2.0 7.1/10AV:N/AC:M/Au:N/C:N/I:N/A:C

Weakness enumeration

CWE-189

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0e033e04c2678dbbe74a46b23fffb7bb918c288eVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.htmlMailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/11/13/9Mailing List, Patch
http://www.ubuntu.com/usn/USN-2113-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2117-1Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1030015Issue Tracking
https://github.com/torvalds/linux/commit/0e033e04c2678dbbe74a46b23fffb7bb918c288eExploit, Patch
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0e033e04c2678dbbe74a46b23fffb7bb918c288eVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.htmlMailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/11/13/9Mailing List, Patch
http://www.ubuntu.com/usn/USN-2113-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2117-1Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1030015Issue Tracking
https://github.com/torvalds/linux/commit/0e033e04c2678dbbe74a46b23fffb7bb918c288eExploit, Patch

Timeline

Published: Nov 20, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-45645.0Libreswan 3.6 allows remote attackers to cause a denial of service (crash) via a small length value and (1) no version or (2) an invalid maj CVE-2013-45656.8Heap-based buffer overflow in the __OLEdecode function in ppthtml 0.5.1 and earlier allows remote attackers to cause a denial of service (cr CVE-2013-45664.0mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in CVE-2013-45674.3Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows CVE-2013-45684.3Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows CVE-2013-45694.3The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in recen CVE-2013-45705.0The zend_inline_hash_func function in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x CVE-2013-45717.5Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 has CVE-2013-45727.5The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cac CVE-2013-45734.3Cross-site scripting (XSS) vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, an CVE-2013-45744.3Cross-site scripting (XSS) vulnerability in the TimeMediaHandler extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x befo CVE-2013-45757.9Heap-based buffer overflow in the utility program in the Linux agent in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2