CVE-2018-14641
18.09.2018, 13:29
A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive, which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial-of-service.Enginsight
| Vendor | Product | Version |
|---|---|---|
| linux | linux_kernel | 4.19:rc1 |
| linux | linux_kernel | 4.19:rc2 |
| linux | linux_kernel | 4.19:rc3 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||
|---|---|---|---|---|---|---|---|
| linux |
| ||||||
| linux-aws |
| ||||||
| linux-azure |
| ||||||
| linux-azure-edge |
| ||||||
| linux-euclid |
| ||||||
| linux-flo |
| ||||||
| linux-gcp |
| ||||||
| linux-gke |
| ||||||
| linux-goldfish |
| ||||||
| linux-grouper |
| ||||||
| linux-hwe |
| ||||||
| linux-hwe-edge |
| ||||||
| linux-kvm |
| ||||||
| linux-lts-trusty |
| ||||||
| linux-lts-utopic |
| ||||||
| linux-lts-vivid |
| ||||||
| linux-lts-wily |
| ||||||
| linux-lts-xenial |
| ||||||
| linux-maguro |
| ||||||
| linux-mako |
| ||||||
| linux-manta |
| ||||||
| linux-oem |
| ||||||
| linux-raspi2 |
| ||||||
| linux-snapdragon |
|
Common Weakness Enumeration
- CWE-456 - Missing Initialization of a VariableThe software does not initialize critical variables, which causes the execution environment to use unexpected values.
- CWE-20 - Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
References