CVE-2018-5803: Input Validation
An error in the "sctpmakechunk()" function (net/sctp/smmakechunk.c) when handling SCTP packets length can be exploited by a malicious local user to cause a kernel crash and a DoS.
References:
https://packetstormsecurity.com/files/146620/secunia-sctpmakechunkdos.txt
https://marc.info/?t=151818093200004&r=1&w=2
https://marc.info/?t=151818682600001&r=1&w=2
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=07f2c7ab6f8d0a7e7c5764c4e6cc9c52951b9d9c
Other sources
In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "sctpmakechunk()" function (net/sctp/smmakechunk.c) when handling SCTP packets length can be exploited to cause a kernel crash.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 4.15.8 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 4.14.25 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 4.9.87 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 4.4.121 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 4.1.51 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 3.2.102
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5803?
CVE-2018-5803 is classified as a high severity vulnerability due to its potential to cause a denial of service through kernel crashes.
How do I fix CVE-2018-5803?
To fix CVE-2018-5803, update your system to the latest patched version of the Linux kernel or affected software.
Which versions of Linux Kernel are affected by CVE-2018-5803?
CVE-2018-5803 affects Linux Kernel versions prior to 3.2.102 and several versions between 3.3 and 4.15.
Can CVE-2018-5803 be exploited remotely?
No, CVE-2018-5803 requires local access to exploit, as it affects handling of SCTP packets.
What are the potential impacts of CVE-2018-5803?
The potential impacts of CVE-2018-5803 include system instability and denial of service due to kernel crashes.