Denial of Service Vulnerability in Linux Kernel - UDP Fragmentation Offload Issue
Summary
DEBIAN-CVE-2013-4470: The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system cra... Affects linux versions < 3.11.7-1. Fixed in 3.11.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It supports a wide range of functionalities, including process management, memory management, and networking. This vulnerability specifically affects the kernel versions prior to 3.12 when the UDP Fragmentation Offload (UFO) feature is enabled, which can lead to severe system instability and potential privilege escalation.
Vulnerability Detail
The vulnerability identified as CVE-2013-4470 arises from improper initialization of certain data structures in the Linux kernel when UDP Fragmentation Offload is enabled. This flaw allows local users to exploit the system by crafting applications that utilize the UDP_CORK option in a setsockopt system call. By sending both short and long packets, attackers can cause memory corruption, leading to a denial of service (system crash) or potentially gain elevated privileges.
How To Fix
Minimum fixed version
3.11.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the UDP Fragmentation Offload feature if it is not critical for their applications. This can be done by modifying the network configuration settings, though it is advisable to apply the patch as soon as possible for long-term security.
Conclusion
CVE-2013-4470 is a significant vulnerability in the Linux kernel that can lead to severe consequences if left unaddressed. Users are strongly encouraged to update their systems to the patched version to ensure security and stability. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2013-4470 is a vulnerability in the Linux kernel that affects versions prior to 3.12, specifically related to UDP Fragmentation Offload.
Exploitation of this vulnerability can lead to memory corruption, system crashes, and potential privilege escalation for local users.
The vulnerability affects all Linux kernel versions prior to 3.12 when UDP Fragmentation Offload is enabled.
Yes, the vulnerability has been patched in version 3.11.7-1 and later. It is recommended to update your Linux package to this version or higher.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
