CIS Logo
tagline: Confidence in the Connected World

A Vulnerability in the Linux Kernel Could Allow for Denial of Service Conditions

MS-ISAC ADVISORY NUMBER:

2018-088

DATE(S) ISSUED:

08/09/2018

OVERVIEW:

A vulnerability has been discovered in the Linux Kernel that could allow for Denial of Service (DoS) conditions over any open TCP port. Linux based operating systems are commonly used for services such as web servers or mail servers. Successful exploitation of this vulnerability could lead to prolonged periods of downtime and loss of functionality.

THREAT INTELLIGENCE:

There are no reports at this time of these vulnerabilities being exploited in the wild.

SYSTEMS AFFECTED:

  • Linux Kernel 4.9+
  • Ubuntu 16.04 - linux azure, linux-gcp, linux-hwe
  • Ubuntu 18.04 - linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux-raspi2
  • Junos OS - MX Series, QFX Series, NFX Series, PTX Series, vMX, vSRX, vQFX, vPTX
  • FreeBSD - All supported versions
  • Debian - 4.9.110-3+deb9u1
  • SUSE Linux Enterprise 15
  • Arista EOS - version 4.20 and lower
  • Arista vEOS - 4.20, 4.18
  • Akamai Technologies
  • Red Hat Enterprise Linux 6, 7, 7 for Real Time, 7 for ARM64, 7 for Power, Atomic Host

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: HIGH
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: HIGH
Home Users:
LOW

TECHNICAL SUMMARY:

A vulnerability has been discovered in the Linux Kernel that could allow for DoS conditions over any open TCP port (CVE-2018-5390). The Linux Kernel version 4.9 is vulnerable, but due to distributions having backported some of the networking code from version 4.9, the scope of the vulnerability is much larger. Exploitation of this vulnerability is asymmetric, requiring a limited number of requests from the attack source. This vulnerability is exploited through the use of specially crafted packets in a TCP session. When triggered, these packets make expensive calls to the CPU that can quickly exhaust available resources. The vulnerable functions, tcp_collapse_ofo_queue() and tcp_prune_ofo_queue(), are used to deal with reassembling TCP segments. This attack requires a continuous two-way TCP connection to an open port, and these attacks cannot be performed using spoofed IP addresses. Successful exploitation of this vulnerability could lead to prolonged periods of down time and loss of functionality.

RECOMENDATIONS:

  • Apply appropriate updates provided by your Linux Distribution Vendor to vulnerable systems, immediately after appropriate testing.
  • Monitor intrusion detection systems for any signs of anomalous activity.
  • Unless required, limit external network access to affected products.

REFERENCES:

CMU CERT Vulnerability Notes Database:
https://www.kb.cert.org/vuls/id/962459

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories

Protect Your Systems from Cyber Threats Like This

CIS Control That Helps Avoid This Issue Arrow CIS Control 3: Continuous Vulnerability Assessment and Remediation CIS Benchmarks and Other Tools for Related Technology Arrow Debian Linux Arrow Juniper Arrow Red Hat Linux Arrow SUSE Linux Arrow Ubuntu Linux