CVE-2018-6923: High severity freebsd kernel vulnerability

Published Sep 4, 2018

Updated

In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial of service due to excessive system resource consumption. This issue can allow a remote attacker who is able to send an arbitrary ip fragments to cause the machine to consume excessive resources.

Affected Software

40 affected components

FreeBSD FreeBSD=2.2

FreeBSD FreeBSD=3.0

FreeBSD FreeBSD=4.3

FreeBSD FreeBSD=4.4

FreeBSD FreeBSD=4.5

FreeBSD FreeBSD=4.6

FreeBSD FreeBSD=4.7

FreeBSD FreeBSD=4.8

FreeBSD FreeBSD=4.9

FreeBSD FreeBSD=4.10

FreeBSD FreeBSD=4.11

FreeBSD FreeBSD=5.0

FreeBSD FreeBSD=5.1

FreeBSD FreeBSD=5.2

FreeBSD FreeBSD=5.3

FreeBSD FreeBSD=5.4

FreeBSD FreeBSD=5.5

FreeBSD FreeBSD=6.0

FreeBSD FreeBSD=6.1

FreeBSD FreeBSD=6.2

FreeBSD FreeBSD=6.3

FreeBSD FreeBSD=6.4

FreeBSD FreeBSD=7.0

FreeBSD FreeBSD=7.1

FreeBSD FreeBSD=7.2

FreeBSD FreeBSD=7.3

FreeBSD FreeBSD=7.4

FreeBSD FreeBSD=8.0

FreeBSD FreeBSD=8.1

FreeBSD FreeBSD=8.2

FreeBSD FreeBSD=8.3

FreeBSD FreeBSD=8.4

FreeBSD FreeBSD=9.0

FreeBSD FreeBSD=9.1

FreeBSD FreeBSD=9.2

FreeBSD FreeBSD=9.3

FreeBSD FreeBSD=10.0

FreeBSD FreeBSD=11.0

FreeBSD FreeBSD=11.1

FreeBSD FreeBSD=11.2

Event History

Sep 4, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-6923?

CVE-2018-6923 has been classified as a high severity vulnerability due to its ability to cause denial of service by exhausting system resources.

How do I fix CVE-2018-6923?

To fix CVE-2018-6923, upgrade to FreeBSD version 11.1-STABLE, 11.2-RELEASE-p2, or 11.1-RELEASE-p13 or later.

What systems are affected by CVE-2018-6923?

CVE-2018-6923 affects FreeBSD systems prior to versions 11.1-STABLE, 11.2-RELEASE-p2, and specific earlier releases.

Can CVE-2018-6923 be exploited remotely?

Yes, CVE-2018-6923 can be exploited remotely by sending crafted IP fragments to the affected system.

What type of vulnerability is CVE-2018-6923?

CVE-2018-6923 is classified as a denial of service vulnerability.