Linux Kernel IP Fragment Reassembly Denial of Service Vulnerability Affecting Cisco Products: August 2018
On August 14, 2018, the Vulnerability Coordination team of the National Cyber Security Centre of Finland (NCSC-FI) and the CERT Coordination Center (CERT/CC) disclosed a vulnerability in the IP stack that is used by the Linux Kernel. This vulnerability is publicly known as FragmentSmack. The vulnerability could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. An attack could be executed by an attacker who can submit a stream of fragmented IPv4 or IPv6 packets that are designed to trigger the issue on an affected device. The vulnerability is due to inefficient IPv4 and IPv6 fragment reassembly algorithms in the IP stack that is used by the affected kernel. Linux Kernel Versions 3.9 and later are known to be affected by this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180824-linux-ip-fragment ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180824-linux-ip-fragment"]
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-5391US | high7.5 | Exploit | ||
The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a… | ||||
references
External citations — patches, advisories, analysis.
- Cisco Bug Search Toolexternal
- CSCvk78927external
- CSCvk78928external
- CSCvk78929external
- CSCvk78931external
- CSCvk78932external
- CSCvk78933external
- CSCvm05464external
remediations (1)
- Workaround
Any workarounds will be documented in product-specific Cisco bugs, which are identified in the “Vulnerable Products” section of this advisory. In many cases, platform-dependent workarounds may be available. Administrators may be able to leverage access control lists (ACLs), Control Plane Policing (CoPP), or other rate limiting measures to control the flow of fragmented packets that reach an affected interface. Off-device mitigations, such as external firewalls or infrastructure ACLs on edge devices, may also effectively control the flow of IP fragments that are directed to management interfaces or control planes of downstream affected devices.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan