CVE-2018-5390
High
Description
Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Linux Kernel
PublishedAug 6, 2018
First seenAug 6, 2018
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- linux linux_kernel4.18 or later
- hp aruba_airwave_amp8.2.7.1 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2018:2785
- usn.ubuntu.com/3741-2/
- access.redhat.com/errata/RHSA-2018:2776
- access.redhat.com/errata/RHSA-2018:2933
- access.redhat.com/errata/RHSA-2018:2403
- access.redhat.com/errata/RHSA-2018:2395
- usn.ubuntu.com/3763-1/
- access.redhat.com/errata/RHSA-2018:2384
- usn.ubuntu.com/3741-1/
- access.redhat.com/errata/RHSA-2018:2402
- access.redhat.com/errata/RHSA-2018:2948
- usn.ubuntu.com/3742-2/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.9 ≤ v < 4.18, 4.18 | 4.18 |
| redhat virtualization | 4.0 | — |
| redhat enterprise_linux_desktop | 7.0 | — |
| redhat enterprise_linux_server | 7.0 | — |
| redhat enterprise_linux_server_aus | 6.4, 6.5, 6.6, 7.2, 7.3, 7.4 | — |
| redhat enterprise_linux_server_eus | 6.4, 6.7, 7.2, 7.3, 7.4, 7.5 | — |
| redhat enterprise_linux_server_tus | 6.6, 7.2, 7.3, 7.4 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
| canonical ubuntu_linux | 12.04, 14.04, 16.04, 18.04 | — |
| debian debian_linux | 8.0, 9.0 | — |
| hp aruba_airwave_amp | v < 8.2.7.1 | 8.2.7.1 |
| hp aruba_clearpass_policy_manager | 6.6.0 ≤ v ≤ 6.6.9, 6.7.0 ≤ v ≤ 6.7.5 | — |
| f5 big-ip_access_policy_manager | 11.5.1 ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_advanced_firewall_manager | 11.5.1 ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_analytics | 11.5.1 ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_application_acceleration_manager | 11.5.1 ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_application_security_manager | 11.5.1 ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_domain_name_system | 11.5.1 ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_edge_gateway | 11.5.1. ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_fraud_protection_service | 11.5.1 ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_global_traffic_manager | 11.5.1 ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_link_controller | 11.5.1 ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_local_traffic_manager | 11.5.1 ≤ v ≤ 11.6.3, 12.0.0 ≤ v ≤ 12.1.3, 13.0.0 < v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_policy_enforcement_manager | 11.5.1 ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 big-ip_webaccelerator | 11.5.1 ≤ v ≤ 11.6.3, 12.1.0 ≤ v ≤ 12.1.3, 13.0.0 ≤ v ≤ 13.1.1, 14.0.0 | — |
| f5 traffix_systems_signaling_delivery_controller | 5.0.0 ≤ v ≤ 5.1.0, 4.4.0 | — |
| a10networks advanced_core_operating_system | 3.2.2, 4.1.0, 4.1.1, 4.1.2, 4.1.4 | — |
| cisco collaboration_meeting_rooms | 1.0 | — |
| cisco digital_network_architecture_center | 1.2 | — |
| cisco expressway | x8.10, x8.10.1, x8.10.2, x8.10.3, x8.10.4, x8.11 | — |
| cisco expressway_series | No range specified | — |
| cisco meeting_management | 1.0, 1.0.1 | — |
| cisco network_assurance_engine | 2.1\(1a\) | — |
| cisco threat_grid-cloud | No range specified | — |
| cisco webex_hybrid_data_security | No range specified | — |
| cisco webex_video_mesh | No range specified | — |
| cisco telepresence_video_communication_server_firmware | x8.10, x8.10.1, x8.10.2, x8.10.3, x8.10.4, x8.11 | — |
| cisco telepresence_conductor_firmware | xc4.3, xc4.3.1, xc4.3.2, xc4.3.3, xc4.3.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.