CVE-2018-5390 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
certcc	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 91%

Vendor	Product	Version
redhat	virtualization	4.0
redhat	enterprise_linux_desktop	7.0
redhat	enterprise_linux_server	7.0
redhat	enterprise_linux_server_aus	6.4
redhat	enterprise_linux_server_aus	6.5
redhat	enterprise_linux_server_aus	6.6
redhat	enterprise_linux_server_aus	7.2
redhat	enterprise_linux_server_aus	7.3
redhat	enterprise_linux_server_aus	7.4
redhat	enterprise_linux_server_eus	6.4
redhat	enterprise_linux_server_eus	6.7
redhat	enterprise_linux_server_eus	7.2
redhat	enterprise_linux_server_eus	7.3
redhat	enterprise_linux_server_eus	7.4
redhat	enterprise_linux_server_eus	7.5
redhat	enterprise_linux_server_tus	6.6
redhat	enterprise_linux_server_tus	7.2
redhat	enterprise_linux_server_tus	7.3
redhat	enterprise_linux_server_tus	7.4
redhat	enterprise_linux_workstation	7.0
linux	linux_kernel	4.9 ≤ 𝑥 < 4.18
linux	linux_kernel	4.18:rc1
linux	linux_kernel	4.18:rc2
linux	linux_kernel	4.18:rc3
linux	linux_kernel	4.18:rc4
linux	linux_kernel	4.18:rc5
linux	linux_kernel	4.18:rc6
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	14.04
canonical	ubuntu_linux	16.04
canonical	ubuntu_linux	18.04
debian	debian_linux	8.0
debian	debian_linux	9.0
hp	aruba_airwave_amp	𝑥 < 8.2.7.1
hp	aruba_clearpass_policy_manager	6.6.0 ≤ 𝑥 ≤ 6.6.9
hp	aruba_clearpass_policy_manager	6.7.0 ≤ 𝑥 ≤ 6.7.5
f5	big-ip_access_policy_manager	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_access_policy_manager	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_access_policy_manager	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_access_policy_manager	14.0.0
f5	big-ip_advanced_firewall_manager	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_advanced_firewall_manager	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_advanced_firewall_manager	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_advanced_firewall_manager	14.0.0
f5	big-ip_analytics	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_analytics	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_analytics	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_analytics	14.0.0
f5	big-ip_application_acceleration_manager	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_application_acceleration_manager	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_application_acceleration_manager	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_application_acceleration_manager	14.0.0
f5	big-ip_application_security_manager	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_application_security_manager	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_application_security_manager	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_application_security_manager	14.0.0
f5	big-ip_domain_name_system	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_domain_name_system	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_domain_name_system	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_domain_name_system	14.0.0
f5	big-ip_edge_gateway	11.5.1. ≤ 𝑥 ≤ 11.6.3
f5	big-ip_edge_gateway	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_edge_gateway	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_edge_gateway	14.0.0
f5	big-ip_fraud_protection_service	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_fraud_protection_service	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_fraud_protection_service	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_fraud_protection_service	14.0.0
f5	big-ip_global_traffic_manager	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_global_traffic_manager	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_global_traffic_manager	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_global_traffic_manager	14.0.0
f5	big-ip_link_controller	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_link_controller	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_link_controller	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_link_controller	14.0.0
f5	big-ip_local_traffic_manager	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_local_traffic_manager	12.0.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_local_traffic_manager	13.0.0 < 𝑥 ≤ 13.1.1
f5	big-ip_local_traffic_manager	14.0.0
f5	big-ip_policy_enforcement_manager	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_policy_enforcement_manager	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_policy_enforcement_manager	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_policy_enforcement_manager	14.0.0
f5	big-ip_webaccelerator	11.5.1 ≤ 𝑥 ≤ 11.6.3
f5	big-ip_webaccelerator	12.1.0 ≤ 𝑥 ≤ 12.1.3
f5	big-ip_webaccelerator	13.0.0 ≤ 𝑥 ≤ 13.1.1
f5	big-ip_webaccelerator	14.0.0
f5	traffix_systems_signaling_delivery_controller	5.0.0 ≤ 𝑥 ≤ 5.1.0
f5	traffix_systems_signaling_delivery_controller	4.4.0
a10networks	advanced_core_operating_system	3.2.2
a10networks	advanced_core_operating_system	3.2.2:p5
a10networks	advanced_core_operating_system	4.1.0
a10networks	advanced_core_operating_system	4.1.0:p11
a10networks	advanced_core_operating_system	4.1.1:p8
a10networks	advanced_core_operating_system	4.1.2
a10networks	advanced_core_operating_system	4.1.2:p4
a10networks	advanced_core_operating_system	4.1.4
a10networks	advanced_core_operating_system	4.1.4:p1
cisco	collaboration_meeting_rooms	1.0
cisco	digital_network_architecture_center	1.2
cisco	expressway_series	-
cisco	meeting_management	1.0
cisco	meeting_management	1.0.1
cisco	network_assurance_engine	2.1\(1a\)
cisco	threat_grid-cloud	-
cisco	webex_hybrid_data_security	-
cisco	webex_video_mesh	-

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bullseye	5.10.223-1 fixed
jessie	not-affected
bullseye (security)	5.10.226-1 fixed
bookworm	6.1.106-3 fixed
bookworm (security)	6.1.112-1 fixed
trixie	6.11.5-1 fixed
sid	6.11.6-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

linux

cosmic	not-affected
bionic	Fixed 4.15.0-30.32 released
xenial	Fixed 4.4.0-133.159 released
trusty	Fixed 3.13.0-155.205 released

linux-aws

cosmic	not-affected
bionic	Fixed 4.15.0-1017.17 released
xenial	Fixed 4.4.0-1065.75 released
trusty	Fixed 4.4.0-1027.30 released

linux-azure

cosmic	not-affected
bionic	Fixed 4.15.0-1019.19 released
xenial	Fixed 4.15.0-1019.19~16.04.1 released
trusty	not-affected

linux-azure-edge

cosmic	dne
bionic	not-affected
xenial	Fixed 4.15.0-1019.19 released
trusty	dne

linux-euclid

cosmic	dne
bionic	dne
xenial	Fixed 4.4.0-9029.31 released
trusty	dne

linux-flo

cosmic	dne
bionic	dne
xenial	ignored
trusty	dne

linux-gcp

cosmic	not-affected
bionic	Fixed 4.15.0-1015.15 released
xenial	Fixed 4.15.0-1015.15~16.04.1 released
trusty	dne

linux-gke

cosmic	dne
bionic	dne
xenial	ignored
trusty	dne

linux-goldfish

cosmic	dne
bionic	dne
xenial	ignored
trusty	dne

linux-grouper

cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-hwe

cosmic	dne
bionic	not-affected
xenial	Fixed 4.15.0-30.32~16.04.1 released
trusty	dne

linux-hwe-edge

cosmic	dne
bionic	not-affected
xenial	Fixed 4.15.0-30.32~16.04.1 released
trusty	dne

linux-kvm

cosmic	not-affected
bionic	Fixed 4.15.0-1017.17 released
xenial	Fixed 4.4.0-1031.37 released
trusty	dne

linux-lts-trusty

cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-lts-utopic

cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-lts-vivid

cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-lts-wily

cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-lts-xenial

cosmic	dne
bionic	dne
xenial	dne
trusty	Fixed 4.4.0-133.159~14.04.1 released

linux-maguro

cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-mako

cosmic	dne
bionic	dne
xenial	ignored
trusty	dne

linux-manta

cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem

cosmic	not-affected
bionic	Fixed 4.15.0-1013.16 released
xenial	ignored
trusty	dne

linux-raspi2

cosmic	not-affected
bionic	Fixed 4.15.0-1018.19 released
xenial	Fixed 4.4.0-1094.102 released
trusty	dne

linux-snapdragon

cosmic	dne
bionic	not-affected
xenial	Fixed 4.4.0-1098.103 released
trusty	dne

Common Weakness Enumeration

CWE-400 - Uncontrolled Resource Consumption
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txt

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181031-02-linux-en

http://www.openwall.com/lists/oss-security/2019/06/28/2

http://www.openwall.com/lists/oss-security/2019/07/06/3

http://www.openwall.com/lists/oss-security/2019/07/06/4

http://www.securityfocus.com/bid/104976

http://www.securitytracker.com/id/1041424

http://www.securitytracker.com/id/1041434

https://access.redhat.com/errata/RHSA-2018:2384

https://access.redhat.com/errata/RHSA-2018:2395

https://access.redhat.com/errata/RHSA-2018:2402

https://access.redhat.com/errata/RHSA-2018:2403

https://access.redhat.com/errata/RHSA-2018:2645

https://access.redhat.com/errata/RHSA-2018:2776

https://access.redhat.com/errata/RHSA-2018:2785

https://access.redhat.com/errata/RHSA-2018:2789

https://access.redhat.com/errata/RHSA-2018:2790

https://access.redhat.com/errata/RHSA-2018:2791

https://access.redhat.com/errata/RHSA-2018:2924

https://access.redhat.com/errata/RHSA-2018:2933

https://access.redhat.com/errata/RHSA-2018:2948

https://cert-portal.siemens.com/productcert/pdf/ssa-377115.pdf

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=1a4f14bab1868b443f0dd3c55b689a478f82e72e

https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0

https://lists.debian.org/debian-lts-announce/2018/08/msg00014.html

https://security.netapp.com/advisory/ntap-20180815-0003/

https://support.f5.com/csp/article/K95343321

https://support.f5.com/csp/article/K95343321?utm_source=f5support&amp%3Butm_medium=RSS

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180824-linux-tcp

https://usn.ubuntu.com/3732-1/

https://usn.ubuntu.com/3732-2/

https://usn.ubuntu.com/3741-1/

https://usn.ubuntu.com/3741-2/

https://usn.ubuntu.com/3742-1/

https://usn.ubuntu.com/3742-2/

https://usn.ubuntu.com/3763-1/

https://www.a10networks.com/support/security-advisories/tcp-ip-cve-2018-5390-segmentsmack

https://www.debian.org/security/2018/dsa-4266

https://www.kb.cert.org/vuls/id/962459

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

https://www.synology.com/support/security/Synology_SA_18_41