CVE-2018-10938

MEDIUM

Linux Kernel - Infinite Loop

Title source: rule
STIX 2.1

Description

A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4. A crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipso_v4_optptr() function in net/ipv4/cipso_ipv4.c leading to a denial-of-service. A certain non-default configuration of LSM (Linux Security Module) and NetLabel should be set up on a system before an attacker could leverage this flaw.

References (9)

Core 9
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2018/q3/179
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3797-2/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3797-1/
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041569
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10938
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105154
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4308

Scores

CVSS v3 5.9
EPSS 0.0437
EPSS Percentile 89.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-835
Status published
Products (9)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
debian/debian_linux 9.0
linux/linux_kernel 4.0 (8 CPE variants)
linux/linux_kernel 4.1 (9 CPE variants)
linux/linux_kernel 4.2 (9 CPE variants)
linux/linux_kernel 4.3 (8 CPE variants)
linux/linux_kernel 4.4 (9 CPE variants)
linux/linux_kernel 4.5 (4 CPE variants)
Published Aug 27, 2018
Tracked Since Feb 18, 2026