Memory Consumption and System Hang Vulnerability in Linux Kernel
Summary
CVE-2018-17977: The Linux kernel 4.14.67 mishandles certain interaction among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, which allows local users to cause a denial of service (memory consumption and system hang)... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a critical component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The vulnerability in question affects the Linux kernel version 4.14.67 and can lead to memory consumption and system hang.
Vulnerability Detail
The vulnerability arises from a mishandling of certain interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets in the Linux kernel. This flaw allows local users with root access to execute crafted applications, leading to a denial of service. An attacker can exploit this vulnerability to consume excessive memory resources and cause the system to hang. This vulnerability has been demonstrated on CentOS 7.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to apply the recommended fix by updating the Linux kernel to the latest version.
Conclusion
The memory consumption and system hang vulnerability in the Linux kernel version 4.14.67 can be addressed by updating the kernel to version 5.10.209-2 or a later version. This vulnerability can be exploited by local users with root access to execute crafted applications, leading to a denial of service. It is important to promptly update the kernel to ensure system security and stability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The vulnerability can result in memory consumption and system hang, leading to a denial of service. It can disrupt normal system operations and potentially impact the availability of services.
Users running Linux systems with the affected Linux kernel version 4.14.67 are potentially vulnerable. Specifically, CentOS 7 users have been demonstrated to be affected.
No, this vulnerability requires local access and root privileges to execute crafted applications. Remote exploitation is not possible.
The recommended mitigation is to update the Linux kernel to the latest version, which includes the necessary patches to address the vulnerability.
There is no specific evidence of active exploits targeting this vulnerability at the moment. However, it is crucial to apply the recommended fix to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
