CVE-2018-5391
High
Description
The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Linux Kernel
PublishedSep 6, 2018
First seenSep 6, 2018
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- f5 big-ip_access_policy_manager11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
- f5 big-ip_advanced_firewall_manager11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
- f5 big-ip_analytics11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
- f5 big-ip_application_acceleration_manager11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
- f5 big-ip_application_security_manager11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
- f5 big-ip_domain_name_system11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
- f5 big-ip_edge_gateway11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
- f5 big-ip_fraud_protection_service11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
- f5 big-ip_global_traffic_manager11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
- f5 big-ip_link_controller11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
- f5 big-ip_local_traffic_manager11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
- f5 big-ip_policy_enforcement_manager11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2018:3540
- access.redhat.com/errata/RHSA-2018:2785
- access.redhat.com/errata/RHSA-2018:3083
- access.redhat.com/errata/RHSA-2018:2925
- usn.ubuntu.com/3741-2/
- access.redhat.com/errata/RHSA-2018:3459
- access.redhat.com/errata/RHSA-2018:2933
- usn.ubuntu.com/3740-2/
- usn.ubuntu.com/3741-1/
- access.redhat.com/errata/RHSA-2018:3590
- access.redhat.com/errata/RHSA-2018:2948
- usn.ubuntu.com/3742-2/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.9 ≤ v ≤ 4.18 | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_server_aus | 6.4, 6.5, 6.6, 7.2, 7.3, 7.4 | — |
| redhat enterprise_linux_server_eus | 6.7, 7.3, 7.4, 7.5 | — |
| redhat enterprise_linux_server_tus | 6.6, 7.2, 7.3, 7.4 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
| debian debian_linux | 8.0, 9.0 | — |
| canonical ubuntu_linux | 12.04, 14.04, 16.04, 18.04 | — |
| microsoft windows_10 | No range specified, 1607, 1703, 1709, 1803 | — |
| microsoft windows_7 | No range specified | — |
| microsoft windows_8.1 | No range specified | — |
| microsoft windows_rt_8.1 | No range specified | — |
| microsoft windows_server_2008 | No range specified, r2 | — |
| microsoft windows_server_2012 | No range specified, r2 | — |
| microsoft windows_server_2016 | No range specified, 1709, 1803 | — |
| f5 big-ip_access_policy_manager | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_advanced_firewall_manager | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_analytics | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_application_acceleration_manager | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_application_security_manager | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_domain_name_system | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_edge_gateway | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_fraud_protection_service | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_global_traffic_manager | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_link_controller | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_local_traffic_manager | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_policy_enforcement_manager | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| f5 big-ip_webaccelerator | 11.5.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5, 13.0.0 ≤ v < 13.1.3, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.4 | 11.6.5.1, 12.1.5, 13.1.3, 14.0.1.1, 14.1.2.4 |
| siemens ruggedcom_rm1224_firmware | v < 6.1 | 6.1 |
| siemens ruggedcom_rox_ii_firmware | v < 2.13.3 | 2.13.3 |
| siemens scalance_m-800_firmware | v < 6.1 | 6.1 |
| siemens scalance_s615_firmware | v < 6.1 | 6.1 |
| siemens scalance_sc-600_firmware | v < 2.0 | 2.0 |
| siemens scalance_w1700_ieee_802.11ac_firmware | v < 2.0 | 2.0 |
| siemens scalance_w700_ieee_802.11a\/b\/g\/n_firmware | v < 6.4 | 6.4 |
| siemens simatic_net_cp_1242-7_firmware | v < 3.2 | 3.2 |
| siemens simatic_net_cp_1243-1_firmware | v < 3.2 | 3.2 |
| siemens simatic_net_cp_1243-7_lte_eu_firmware | v < 3.2 | 3.2 |
| siemens simatic_net_cp_1243-7_lte_us_firmware | v < 3.2 | 3.2 |
| siemens simatic_net_cp_1243-8_irc_firmware | v < 3.2 | 3.2 |
| siemens simatic_net_cp_1542sp-1_firmware | v < 2.1 | 2.1 |
| siemens simatic_net_cp_1542sp-1_irc_firmware | v < 2.1 | 2.1 |
| siemens simatic_net_cp_1543-1_firmware | v < 2.2 | 2.2 |
| siemens simatic_net_cp_1543sp-1_firmware | v < 2.1 | 2.1 |
| siemens simatic_rf185c_firmware | v < 1.3 | 1.3 |
| siemens simatic_rf186c_firmware | v < 1.3 | 1.3 |
| siemens simatic_rf186ci_firmware | v < 1.3 | 1.3 |
| siemens simatic_rf188_firmware | v < 1.3 | 1.3 |
| siemens simatic_rf188ci_firmware | v < 1.3 | 1.3 |
| siemens sinema_remote_connect_server_firmware | 1.1 ≤ v < 2.0.1 | 2.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.