CVE-2018-10938: Medium severity Linux Linux kernel vulnerability
A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4. A crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipsov4optptr() function in net/ipv4/cipsoipv4.c leading to a denial-of-service. A certain non-default configuration of LSM (Linux Security Module) and NetLabel should be set up on a system before an attacker could leverage this flaw.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Frequently Asked Questions
What is CVE-2018-10938?
CVE-2018-10938 is a vulnerability in the Linux kernel that allows a remote attacker to cause a denial-of-service by sending a crafted network packet.
Which versions of Linux are affected by CVE-2018-10938?
Linux kernel versions from v4.0-rc1 to v4.13-rc4 are affected by CVE-2018-10938.
How can CVE-2018-10938 be exploited?
CVE-2018-10938 can be exploited by sending a specially crafted network packet remotely.
What is the impact of CVE-2018-10938?
The impact of CVE-2018-10938 is a denial-of-service, as the vulnerability can cause the kernel to enter an infinite loop.
Is there a fix available for CVE-2018-10938?
Yes, a fix has been provided in Linux kernel version 4.13~ and later.