Description

The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-20

Affected software

Vendor	Product	Versions
Linux	Kernel	>= 3.9, < 3.9*

References

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txtThird Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-linux-enBroken Link
http://www.openwall.com/lists/oss-security/2019/06/28/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/07/06/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/07/06/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/105108Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041476Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041637Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2785Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2791Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2846Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2924Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2925Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2933Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2948Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3083Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3096Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3459Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3540Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3586Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3590Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-377115.pdfThird Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=c30f1fc041b74ecdb072dd44f858750414b8b19fPatch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00014.htmlMailing List, Mitigation, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00017.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20181003-0002/Third Party Advisory
https://support.f5.com/csp/article/K74374841?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/3740-1/Third Party Advisory
https://usn.ubuntu.com/3740-2/Third Party Advisory
https://usn.ubuntu.com/3741-1/Third Party Advisory
https://usn.ubuntu.com/3741-2/Third Party Advisory
https://usn.ubuntu.com/3742-1/Third Party Advisory
https://usn.ubuntu.com/3742-2/Third Party Advisory
https://www.debian.org/security/2018/dsa-4272Mitigation, Third Party Advisory
https://www.kb.cert.org/vuls/id/641765Third Party Advisory, US Government Resource
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txtThird Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-linux-enBroken Link
http://www.openwall.com/lists/oss-security/2019/06/28/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/07/06/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/07/06/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/105108Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041476Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041637Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2785Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2791Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2846Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2924Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2925Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2933Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2948Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3083Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3096Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3459Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3540Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3586Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3590Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-377115.pdfThird Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=c30f1fc041b74ecdb072dd44f858750414b8b19fPatch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00014.htmlMailing List, Mitigation, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00017.htmlMailing List, Third Party Advisory

Timeline

Published: Sep 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified