CVE-2018-5390

EPSS 73.72%
Veröffentlicht 06.08.2018 20:29:01
Zuletzt bearbeitet 21.11.2024 04:08:43
Erkennungen
Login

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 45

NVD 125 VulnDex Vulnerability Enrichment 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Redhat ≫ Virtualization Version 4.0

Redhat ≫ Enterprise Linux Desktop Version 7.0

Redhat ≫ Enterprise Linux Server Version 7.0

Redhat ≫ Enterprise Linux Server Aus Version 6.4

Redhat ≫ Enterprise Linux Server Aus Version 6.5

Redhat ≫ Enterprise Linux Server Aus Version 6.6

Redhat ≫ Enterprise Linux Server Aus Version 7.2

Redhat ≫ Enterprise Linux Server Aus Version 7.3

Redhat ≫ Enterprise Linux Server Aus Version 7.4

Redhat ≫ Enterprise Linux Server Eus Version 6.4

Redhat ≫ Enterprise Linux Server Eus Version 6.7

Redhat ≫ Enterprise Linux Server Eus Version 7.2

Redhat ≫ Enterprise Linux Server Eus Version 7.3

Redhat ≫ Enterprise Linux Server Eus Version 7.4

Redhat ≫ Enterprise Linux Server Eus Version 7.5

Redhat ≫ Enterprise Linux Server Tus Version 6.6

Redhat ≫ Enterprise Linux Server Tus Version 7.2

Redhat ≫ Enterprise Linux Server Tus Version 7.3

Redhat ≫ Enterprise Linux Server Tus Version 7.4

Redhat ≫ Enterprise Linux Workstation Version 7.0

Linux ≫ Linux Kernel Version >= 4.9 < 4.18

Linux ≫ Linux Kernel Version 4.18 Update rc1

Linux ≫ Linux Kernel Version 4.18 Update rc2

Linux ≫ Linux Kernel Version 4.18 Update rc3

Linux ≫ Linux Kernel Version 4.18 Update rc4

Linux ≫ Linux Kernel Version 4.18 Update rc5

Linux ≫ Linux Kernel Version 4.18 Update rc6

Canonical ≫ Ubuntu Linux Version 12.04 SwEdition esm

Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts

Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts

Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts

Debian ≫ Debian Linux Version 8.0

Debian ≫ Debian Linux Version 9.0

Hp ≫ Aruba Airwave Amp Version < 8.2.7.1

Hp ≫ Aruba Clearpass Policy Manager Version >= 6.6.0 <= 6.6.9

Hp ≫ Aruba Clearpass Policy Manager Version >= 6.7.0 <= 6.7.5

F5 ≫ Big-ip Access Policy Manager Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Access Policy Manager Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Access Policy Manager Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Access Policy Manager Version 14.0.0

F5 ≫ Big-ip Advanced Firewall Manager Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Advanced Firewall Manager Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Advanced Firewall Manager Version 14.0.0

F5 ≫ Big-ip Analytics Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Analytics Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Analytics Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Analytics Version 14.0.0

F5 ≫ Big-ip Application Acceleration Manager Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Application Acceleration Manager Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Application Acceleration Manager Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Application Acceleration Manager Version 14.0.0

F5 ≫ Big-ip Application Security Manager Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Application Security Manager Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Application Security Manager Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Application Security Manager Version 14.0.0

F5 ≫ Big-ip Domain Name System Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Domain Name System Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Domain Name System Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Domain Name System Version 14.0.0

F5 ≫ Big-ip Edge Gateway Version >= 11.5.1. <= 11.6.3

F5 ≫ Big-ip Edge Gateway Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Edge Gateway Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Edge Gateway Version 14.0.0

F5 ≫ Big-ip Fraud Protection Service Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Fraud Protection Service Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Fraud Protection Service Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Fraud Protection Service Version 14.0.0

F5 ≫ Big-ip Global Traffic Manager Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Global Traffic Manager Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Global Traffic Manager Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Global Traffic Manager Version 14.0.0

F5 ≫ Big-ip Link Controller Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Link Controller Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Link Controller Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Link Controller Version 14.0.0

F5 ≫ Big-ip Local Traffic Manager Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Local Traffic Manager Version >= 12.0.0 <= 12.1.3

F5 ≫ Big-ip Local Traffic Manager Version > 13.0.0 <= 13.1.1

F5 ≫ Big-ip Local Traffic Manager Version 14.0.0

F5 ≫ Big-ip Policy Enforcement Manager Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Policy Enforcement Manager Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Policy Enforcement Manager Version 14.0.0

F5 ≫ Big-ip Webaccelerator Version >= 11.5.1 <= 11.6.3

F5 ≫ Big-ip Webaccelerator Version >= 12.1.0 <= 12.1.3

F5 ≫ Big-ip Webaccelerator Version >= 13.0.0 <= 13.1.1

F5 ≫ Big-ip Webaccelerator Version 14.0.0

F5 ≫ Traffix Systems Signaling Delivery Controller Version >= 5.0.0 <= 5.1.0

F5 ≫ Traffix Systems Signaling Delivery Controller Version 4.4.0

A10networks ≫ Advanced Core Operating System Version 3.2.2

A10networks ≫ Advanced Core Operating System Version 3.2.2 Update p5

A10networks ≫ Advanced Core Operating System Version 4.1.0

A10networks ≫ Advanced Core Operating System Version 4.1.0 Update p11

A10networks ≫ Advanced Core Operating System Version 4.1.1 Update p8

A10networks ≫ Advanced Core Operating System Version 4.1.2

A10networks ≫ Advanced Core Operating System Version 4.1.2 Update p4

A10networks ≫ Advanced Core Operating System Version 4.1.4

A10networks ≫ Advanced Core Operating System Version 4.1.4 Update p1

Cisco ≫ Collaboration Meeting Rooms Version 1.0

Cisco ≫ Digital Network Architecture Center Version 1.2

Cisco ≫ Expressway Version x8.10

Cisco ≫ Expressway Version x8.10.1

Cisco ≫ Expressway Version x8.10.2

Cisco ≫ Expressway Version x8.10.3

Cisco ≫ Expressway Version x8.10.4

Cisco ≫ Expressway Version x8.11

Cisco ≫ Expressway Series Version -

Cisco ≫ Meeting Management Version 1.0

Cisco ≫ Meeting Management Version 1.0.1

Cisco ≫ Network Assurance Engine Version 2.1(1a)

Cisco ≫ Threat Grid-cloud Version -

Cisco ≫ Webex Hybrid Data Security Version -

Cisco ≫ Webex Video Mesh Version -

Cisco ≫ Telepresence Video Communication Server Firmware Version x8.10

Cisco ≫ Telepresence Video Communication Server Version -

Cisco ≫ Telepresence Video Communication Server Firmware Version x8.10.1

Cisco ≫ Telepresence Video Communication Server Version -

Cisco ≫ Telepresence Video Communication Server Firmware Version x8.10.2

Cisco ≫ Telepresence Video Communication Server Version -

Cisco ≫ Telepresence Video Communication Server Firmware Version x8.10.3

Cisco ≫ Telepresence Video Communication Server Version -

Cisco ≫ Telepresence Video Communication Server Firmware Version x8.10.4

Cisco ≫ Telepresence Video Communication Server Version -

Cisco ≫ Telepresence Video Communication Server Firmware Version x8.11

Cisco ≫ Telepresence Video Communication Server Version -

Cisco ≫ Telepresence Conductor Firmware Version xc4.3

Cisco ≫ Telepresence Conductor Version -

Cisco ≫ Telepresence Conductor Firmware Version xc4.3.1

Cisco ≫ Telepresence Conductor Version -

Cisco ≫ Telepresence Conductor Firmware Version xc4.3.2

Cisco ≫ Telepresence Conductor Version -

Cisco ≫ Telepresence Conductor Firmware Version xc4.3.3

Cisco ≫ Telepresence Conductor Version -

Cisco ≫ Telepresence Conductor Firmware Version xc4.3.4

Cisco ≫ Telepresence Conductor Version -

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	73.72%	0.994

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST	7.8	10	6.9	AV:N/AC:L/Au:N/C:N/I:N/A:C

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Patch

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Third Party Advisory

http://www.openwall.com/lists/oss-security/2019/06/28/2

Third Party Advisory

Mailing List

https://access.redhat.com/errata/RHSA-2018:2948

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2384

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2395

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2785

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2791

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2924

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2933

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/08/msg00014.html

Third Party Advisory

https://www.debian.org/security/2018/dsa-4266

Third Party Advisory

https://usn.ubuntu.com/3742-1/

Third Party Advisory

https://usn.ubuntu.com/3742-2/

Third Party Advisory

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txt

Third Party Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181031-02-linux-en

Third Party Advisory

http://www.openwall.com/lists/oss-security/2019/07/06/3

Third Party Advisory

Mailing List

http://www.openwall.com/lists/oss-security/2019/07/06/4

Third Party Advisory

Mailing List

http://www.securityfocus.com/bid/104976

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1041424

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1041434

Third Party Advisory

VDB Entry

https://access.redhat.com/errata/RHSA-2018:2402

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2403

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2645

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2776

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2789

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2790

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-377115.pdf

Third Party Advisory

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=1a4f14bab1868b443f0dd3c55b689a478f82e72e

Patch

Vendor Advisory

https://security.netapp.com/advisory/ntap-20180815-0003/

Third Party Advisory

https://support.f5.com/csp/article/K95343321

Third Party Advisory

https://support.f5.com/csp/article/K95343321?utm_source=f5support&amp%3Butm_medium=RSS

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180824-linux-tcp

Third Party Advisory

https://usn.ubuntu.com/3732-1/

Third Party Advisory

https://usn.ubuntu.com/3732-2/

Third Party Advisory

https://usn.ubuntu.com/3741-1/

Third Party Advisory

https://usn.ubuntu.com/3741-2/

Third Party Advisory

https://usn.ubuntu.com/3763-1/

Third Party Advisory

https://www.a10networks.com/support/security-advisories/tcp-ip-cve-2018-5390-segmentsmack

Third Party Advisory

Mitigation

https://www.kb.cert.org/vuls/id/962459

Third Party Advisory

US Government Resource

https://www.synology.com/support/security/Synology_SA_18_41

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-5390

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-5390

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-5390

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2018-5390