What is CVE-2018-5390?

CVE-2018-5390 is a vulnerability in Linux Kernel, classified under Uncontrolled Resource Consumption. Published 2018-08-06.

Is CVE-2018-5390 known to be exploited?

6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in Linux Kernel

CVE-2018-5390

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.

Vulnerability class: DoS (Denial of Service)

EPSS: 0.735 (99.4th percentile) — read the EPSS interpretation.

Affected products

Linux Kernel — versions 4.9

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

Public proof-of-concept exploits

References

RHSA-2018:2785 (vendor-advisory, x_refsource_REDHAT)
VU#962459 (third-party-advisory, x_refsource_CERT-VN)
USN-3741-2 (vendor-advisory, x_refsource_UBUNTU)
RHSA-2018:2776 (vendor-advisory, x_refsource_REDHAT)
RHSA-2018:2933 (vendor-advisory, x_refsource_REDHAT)
RHSA-2018:2403 (vendor-advisory, x_refsource_REDHAT)
RHSA-2018:2395 (vendor-advisory, x_refsource_REDHAT)
USN-3763-1 (vendor-advisory, x_refsource_UBUNTU)
RHSA-2018:2384 (vendor-advisory, x_refsource_REDHAT)
USN-3741-1 (vendor-advisory, x_refsource_UBUNTU)

Frequently asked questions

What is CVE-2018-5390?: CVE-2018-5390 is a vulnerability in Linux Kernel, classified under Uncontrolled Resource Consumption. Published 2018-08-06.
Is CVE-2018-5390 known to be exploited?: 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.