CVE-2018-5391
📋 TL;DR
CVE-2018-5391 is a Linux kernel vulnerability that allows remote attackers to cause a denial of service by sending specially crafted IP fragments that overwhelm the fragment reassembly queue. This affects Linux kernel versions 3.9 and later, making most modern Linux systems vulnerable. The attack requires low packet rates, making it relatively easy to execute.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Scalance W1700 Ieee 802.11ac Firmware by Siemens
View all CVEs affecting Scalance W1700 Ieee 802.11ac Firmware →
Scalance W700 Ieee 802.11a\/b\/g\/n Firmware by Siemens
View all CVEs affecting Scalance W700 Ieee 802.11a\/b\/g\/n Firmware →
Simatic Net Cp 1243 7 Lte Eu Firmware by Siemens
View all CVEs affecting Simatic Net Cp 1243 7 Lte Eu Firmware →
Simatic Net Cp 1243 7 Lte Us Firmware by Siemens
View all CVEs affecting Simatic Net Cp 1243 7 Lte Us Firmware →
Simatic Net Cp 1243 8 Irc Firmware by Siemens
View all CVEs affecting Simatic Net Cp 1243 8 Irc Firmware →
Simatic Net Cp 1542sp 1 Firmware by Siemens
Simatic Net Cp 1542sp 1 Irc Firmware by Siemens
View all CVEs affecting Simatic Net Cp 1542sp 1 Irc Firmware →
Simatic Net Cp 1543sp 1 Firmware by Siemens
Sinema Remote Connect Server Firmware by Siemens
View all CVEs affecting Sinema Remote Connect Server Firmware →
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability requiring reboot, affecting all network services on the target system.
Likely Case
Degraded network performance and intermittent service disruptions affecting TCP-based applications.
If Mitigated
Minimal impact with proper network filtering and rate limiting in place.
🎯 Exploit Status
Exploit code has been published in security advisories. The attack requires sending specially crafted IP fragments at relatively low rates (as low as 30 Mbps).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with fixes backported to various distributions. Check specific distribution advisories.
Vendor Advisory: https://www.kernel.org/
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution's repository. 2. For Red Hat/CentOS: yum update kernel. 3. For Ubuntu/Debian: apt update && apt upgrade linux-image-*. 4. Reboot system to load new kernel.
🔧 Temporary Workarounds
Reduce IP fragment reassembly queue size
linuxLower the maximum number of IP fragments that can be queued for reassembly
sysctl -w net.ipv4.ipfrag_high_thresh=262144
sysctl -w net.ipv4.ipfrag_low_thresh=196608
Enable IP fragment filtering
linuxDrop IP fragments at network perimeter
iptables -A INPUT -f -j DROP
🧯 If You Can't Patch
- Implement network filtering to drop IP fragments at perimeter firewalls
- Use intrusion prevention systems (IPS) to detect and block fragment-based attacks
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r. If version is 3.9 or higher and not patched, system is vulnerable.Check Version:
uname -rVerify Fix Applied:
Check if kernel has been updated to a version that includes the fix. For Red Hat: rpm -q kernel. For Ubuntu: dpkg -l | grep linux-image.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- High system load without apparent cause
- Network interface errors
Network Indicators:
- Unusual IP fragment traffic patterns
- High rate of fragmented packets
- TCP connection timeouts
SIEM Query:
source="kernel" AND ("panic" OR "Oops") OR (source="firewall" AND "fragment" AND rate>1000)🔗 References
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txt
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-linux-en
- http://www.openwall.com/lists/oss-security/2019/06/28/2
- http://www.openwall.com/lists/oss-security/2019/07/06/3
- http://www.openwall.com/lists/oss-security/2019/07/06/4
- http://www.securityfocus.com/bid/105108
- http://www.securitytracker.com/id/1041476
- http://www.securitytracker.com/id/1041637
- https://access.redhat.com/errata/RHSA-2018:2785
- https://access.redhat.com/errata/RHSA-2018:2791
- https://access.redhat.com/errata/RHSA-2018:2846
- https://access.redhat.com/errata/RHSA-2018:2924
- https://access.redhat.com/errata/RHSA-2018:2925
- https://access.redhat.com/errata/RHSA-2018:2933
- https://access.redhat.com/errata/RHSA-2018:2948
- https://access.redhat.com/errata/RHSA-2018:3083
- https://access.redhat.com/errata/RHSA-2018:3096
- https://access.redhat.com/errata/RHSA-2018:3459
- https://access.redhat.com/errata/RHSA-2018:3540
- https://access.redhat.com/errata/RHSA-2018:3586
- https://access.redhat.com/errata/RHSA-2018:3590
- https://cert-portal.siemens.com/productcert/pdf/ssa-377115.pdf
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=c30f1fc041b74ecdb072dd44f858750414b8b19f
- https://lists.debian.org/debian-lts-announce/2018/08/msg00014.html
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
- https://security.netapp.com/advisory/ntap-20181003-0002/
- https://support.f5.com/csp/article/K74374841?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/3740-1/
- https://usn.ubuntu.com/3740-2/
- https://usn.ubuntu.com/3741-1/
- https://usn.ubuntu.com/3741-2/
- https://usn.ubuntu.com/3742-1/
- https://usn.ubuntu.com/3742-2/
- https://www.debian.org/security/2018/dsa-4272
- https://www.kb.cert.org/vuls/id/641765
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txt
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-linux-en
- http://www.openwall.com/lists/oss-security/2019/06/28/2
- http://www.openwall.com/lists/oss-security/2019/07/06/3
- http://www.openwall.com/lists/oss-security/2019/07/06/4
- http://www.securityfocus.com/bid/105108
- http://www.securitytracker.com/id/1041476
- http://www.securitytracker.com/id/1041637
- https://access.redhat.com/errata/RHSA-2018:2785
- https://access.redhat.com/errata/RHSA-2018:2791
- https://access.redhat.com/errata/RHSA-2018:2846
- https://access.redhat.com/errata/RHSA-2018:2924
- https://access.redhat.com/errata/RHSA-2018:2925
- https://access.redhat.com/errata/RHSA-2018:2933
- https://access.redhat.com/errata/RHSA-2018:2948
- https://access.redhat.com/errata/RHSA-2018:3083
- https://access.redhat.com/errata/RHSA-2018:3096
- https://access.redhat.com/errata/RHSA-2018:3459
- https://access.redhat.com/errata/RHSA-2018:3540
- https://access.redhat.com/errata/RHSA-2018:3586
- https://access.redhat.com/errata/RHSA-2018:3590
- https://cert-portal.siemens.com/productcert/pdf/ssa-377115.pdf
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=c30f1fc041b74ecdb072dd44f858750414b8b19f
- https://lists.debian.org/debian-lts-announce/2018/08/msg00014.html
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
- https://security.netapp.com/advisory/ntap-20181003-0002/
- https://support.f5.com/csp/article/K74374841?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/3740-1/
- https://usn.ubuntu.com/3740-2/
- https://usn.ubuntu.com/3741-1/
- https://usn.ubuntu.com/3741-2/
- https://usn.ubuntu.com/3742-1/
- https://usn.ubuntu.com/3742-2/
- https://www.debian.org/security/2018/dsa-4272
- https://www.kb.cert.org/vuls/id/641765
