PT-2018-3419 · Linux+2 · Linux Kernel+2
Yves Younan
·
Publicado
2018-08-27
·
Atualizado
2019-10-03
·
CVE-2018-10938
CVSS v2.0
7.1
Alta
| Vetor | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions 4.0-rc1 through 4.13-rc4
Description:
A flaw in the Linux kernel may cause it to enter an infinite loop in the
cipso v4 optptr() function when a crafted network packet is sent remotely, leading to a denial-of-service. This issue can be exploited if a certain non-default configuration of LSM (Linux Security Module) and NetLabel is set up on the system.Recommendations:
For Linux kernel versions 4.0-rc1 through 4.13-rc4, as a temporary workaround, consider disabling the
cipso v4 optptr() function until a patch is available. Restrict access to the net/ipv4/cipso ipv4.c module to minimize the risk of exploitation. Avoid using non-default configurations of LSM and NetLabel that could enable this flaw. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Infinite Loop
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Linux Kernel
Suse
Ubuntu