CVE-2018-14641 Denial of service in kernel
Remote attackers can cause a system crash in the Linux kernel via IP fragment reassembly flaws, requiring specific non-default host configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-14641?
CVE-2018-14641 is a medium-severity denial of service vulnerability in Linux kernel, published on 18 Sep 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive, which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial-of-service.
Which versions are affected by CVE-2018-14641?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2018-14641?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-14641 being exploited?
There is no known exploitation of CVE-2018-14641 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as GHSA-2jfx-4v33-68mf.