UDP Fragmentation Offload Vulnerability in Linux Package
Summary
DEBIAN-CVE-2013-4387: net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote... Affects linux versions < 3.11.5-1. Fixed in 3.11.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is known for its stability, performance, and extensive support for various hardware architectures. However, vulnerabilities can arise, such as the one identified in CVE-2013-4387, which affects the handling of UDP Fragmentation Offload (UFO) processing, potentially leading to system crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2013-4387, exists in the net/ipv6/ip6_output.c file of the Linux kernel up to version 3.11.4. It fails to correctly determine the need for UDP Fragmentation Offload processing for small packets after a large packet has been queued. This oversight allows remote attackers to exploit the vulnerability by sending crafted network traffic, which can lead to memory corruption, system crashes, or other unspecified impacts.
How To Fix
Minimum fixed version
3.11.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators may consider disabling UDP Fragmentation Offload if feasible, though this may impact network performance. Specific commands to disable UFO can vary based on the network configuration and should be tested in a controlled environment.
Conclusion
CVE-2013-4387 is a significant vulnerability in the Linux kernel that can lead to severe system issues if not addressed. It is crucial for users to update their systems to the patched version to mitigate risks. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2013-4387 is a vulnerability in the Linux kernel that affects the processing of UDP Fragmentation Offload, potentially leading to system crashes.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software by analyzing the manifest file. Visit Vulert Scanner to check your application without needing to sign up.
The risks include denial of service due to memory corruption and potential system crashes, which can disrupt services and affect system stability.
Yes, updating the Linux package to version 3.11.5-1 or later resolves the vulnerability.
If immediate updates are not possible, consider implementing workarounds such as disabling UDP Fragmentation Offload, but be aware of the potential impact on network performance.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
