← back
CVE-2018-5390CWE-400

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 74%
exploitation probability
74%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Affected
1 product
Red Hat Enterprise Linux 5
no_fix_planned: Will not fix
Fixed
50 products (945 components)
Red Hat Enterprise Linux Server (v. 7) · Red Hat Enterprise Linux Server EUS (v. 7.3) · Red Hat Enterprise Linux Server EUS (v. 7.4) · Red Hat Enterprise Linux Server (v. 6) · Red Hat Enterprise Linux Server EUS (v. 6.7) · and others 45
Not affected
1 product (32 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 8
In short

An attacker can send specially crafted network packets to a Linux system running kernel 4.9 or later, forcing it to perform expensive processing for each packet, which can overwhelm the system and make it unresponsive to legitimate users.

Technical detail

A remote attacker can exploit algorithmic complexity in the TCP stack (CWE-400) by sending crafted out-of-order packets that trigger expensive tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() operations on every incoming packet, causing CPU exhaustion and denial of service without requiring authentication or special privileges.

Summary generated and translated by AI from the official description.
Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.
Affected products
Linux · Linux Kernel