Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 27 Aug 2018 05:25:15 -0400 (EDT)
From: Vladis Dronov <>
Subject: CVE-2018-10938: Linux kernel: net: infinite loop in
 net/ipv4/cipso_ipv4.c:cipso_v4_optptr() allows a remote DoS


A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4.
A crafted network packet sent remotely by an attacker may force the kernel to enter
an infinite loop in the cipso_v4_optptr() function in net/ipv4/cipso_ipv4.c leading
to a denial-of-service.

All the kernels with the cipso_v4_optptr() function which have not backported
the upstream commit 40413955ee26 are vulnerable.

Thanks to Yves Younan from Cisco for mentioning this.


Upstream Patch introduced the flaw:

Upstream Patch fixed the flaw:

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.