CVE-2018-6918 - OpenCVE

In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Complete

AV:N/AC:L/Au:N/C:N/I:N/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Freebsd	Freebsd

Configuration 1 [-]

OR	cpe:2.3:o:freebsd:freebsd::::::::
	cpe:2.3:o:freebsd:freebsd::::::::

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2019/Jun/6
http://www.securityfocus.com/bid/103666
http://www.securitytracker.com/id/1040628
https://seclists.org/bugtraq/2019/May/77
https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.asc
https://support.apple.com/kb/HT210090
https://support.apple.com/kb/HT210091

History

No history.

MITRE

Status: PUBLISHED

Assigner: freebsd

Published: 2018-04-04T14:00:00Z

Updated: 2024-09-17T02:12:06.548Z

Reserved: 2018-02-12T00:00:00

Link: CVE-2018-6918

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-04-04T14:29:00.293

Modified: 2019-10-03T00:03:26.223

Link: CVE-2018-6918

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"status": "affected", "version": "All supported versions of FreeBSD."}]}], "datePublic": "2018-04-04T00:00:00", "descriptions": [{"lang": "en", "value": "In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash."}], "problemTypes": [{"descriptions": [{"description": "Kernel crash or denial of service", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-06-20T20:06:04", "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd"}, "references": [{"name": "1040628", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1040628"}, {"name": "FreeBSD-SA-18:05", "tags": ["vendor-advisory", "x_refsource_FREEBSD"], "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.asc"}, {"name": "103666", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/103666"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.apple.com/kb/HT210090"}, {"name": "20190531 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "https://seclists.org/bugtraq/2019/May/77"}, {"name": "20190611 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2019/Jun/6"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.apple.com/kb/HT210091"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secteam@freebsd.org", "DATE_PUBLIC": "2018-04-04T00:00:00", "ID": "CVE-2018-6918", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "FreeBSD", "version": {"version_data": [{"version_value": "All supported versions of FreeBSD."}]}}]}, "vendor_name": "FreeBSD"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Kernel crash or denial of service"}]}]}, "references": {"reference_data": [{"name": "1040628", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1040628"}, {"name": "FreeBSD-SA-18:05", "refsource": "FREEBSD", "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.asc"}, {"name": "103666", "refsource": "BID", "url": "http://www.securityfocus.com/bid/103666"}, {"name": "https://support.apple.com/kb/HT210090", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT210090"}, {"name": "20190531 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/May/77"}, {"name": "20190611 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2019/Jun/6"}, {"name": "https://support.apple.com/kb/HT210091", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT210091"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:17:17.259Z"}, "title": "CVE Program Container", "references": [{"name": "1040628", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1040628"}, {"name": "FreeBSD-SA-18:05", "tags": ["vendor-advisory", "x_refsource_FREEBSD", "x_transferred"], "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.asc"}, {"name": "103666", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/103666"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.apple.com/kb/HT210090"}, {"name": "20190531 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "https://seclists.org/bugtraq/2019/May/77"}, {"name": "20190611 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2019/Jun/6"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.apple.com/kb/HT210091"}]}]}, "cveMetadata": {"assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "assignerShortName": "freebsd", "cveId": "CVE-2018-6918", "datePublished": "2018-04-04T14:00:00Z", "dateReserved": "2018-02-12T00:00:00", "dateUpdated": "2024-09-17T02:12:06.548Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*", "matchCriteriaId": "E766E867-C66B-4EAD-8A14-C6D194544438", "versionEndExcluding": "10.4", "versionStartIncluding": "10.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*", "matchCriteriaId": "702C5136-33B6-4F0F-8FF7-C2BE3668DE70", "versionEndExcluding": "11.1", "versionStartIncluding": "11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash."}, {"lang": "es", "value": "En FreeBSD, en versiones anteriores a 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 y 10.3-RELEASE-p28, el campo length de la cabecera de opci\u00f3n ipsec no cuenta el tama\u00f1o de la propia cabecera de opci\u00f3n. Esto provoca un bucle infinito cuando la longitud es cero. Este problema puede permitir que un atacante remoto que pueda enviar un paquete arbitrario haga que la m\u00e1quina se cierre inesperadamente."}], "id": "CVE-2018-6918", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.8, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-04-04T14:29:00.293", "references": [{"source": "secteam@freebsd.org", "url": "http://seclists.org/fulldisclosure/2019/Jun/6"}, {"source": "secteam@freebsd.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/103666"}, {"source": "secteam@freebsd.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1040628"}, {"source": "secteam@freebsd.org", "url": "https://seclists.org/bugtraq/2019/May/77"}, {"source": "secteam@freebsd.org", "tags": ["Vendor Advisory"], "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.asc"}, {"source": "secteam@freebsd.org", "url": "https://support.apple.com/kb/HT210090"}, {"source": "secteam@freebsd.org", "url": "https://support.apple.com/kb/HT210091"}], "sourceIdentifier": "secteam@freebsd.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}]}