CVE-2018-10938

Published: 27 August 2018

A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4. A crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipso_v4_optptr() function in net/ipv4/cipso_ipv4.c leading to a denial-of-service. A certain non-default configuration of LSM (Linux Security Module) and NetLabel should be set up on a system before an attacker could leverage this flaw.

From the Ubuntu Security Team

Yves Younan discovered that the CIPSO labeling implementation in the Linux kernel did not properly handle IP header options in some situations. A remote attacker could use this to specially craft network traffic that could cause a denial of service (infinite loop).

Notes

This issue affects non-default configurations where SELinux or SMACK
is being used instead of AppArmor and networking labeling has been
configured. It is unlikely that Ubuntu users would be affected by this issue.

further hardening discussion (and why it's likely not
needed) around this code in the two netdev emails in the marc.info
urls in the references section

Status

Severity score breakdown

References

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=40413955ee265a5e42f710940ec78f5450d49149
• http://www.openwall.com/lists/oss-security/2018/08/27/1
• http://seclists.org/oss-sec/2018/q3/179
• https://marc.info/?t=153719718600001&r=1&w=2
• https://marc.info/?t=153720664100001&r=1&w=2
• https://ubuntu.com/security/notices/USN-3797-1
• https://ubuntu.com/security/notices/USN-3797-2
• https://www.cve.org/CVERecord?id=CVE-2018-10938
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10938