CVE-2018-5391: The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packets
Modified
AliasesSUSE-SU-2018:3792-1SUSE-SU-2018:3860-1SUSE-SU-2018:3881-1UBUNTU-CVE-2018-5391DEBIAN-CVE-2018-5391DSA-4272-1
Published 06-09-2018Last modified 05-08-2024
Vulnerability summary
CVE-2018-5391 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in canonical ubuntu_linux. EPSS estimates a 32.45% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 32% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
7.8/10
010
High · v2.0 (NVD)EPSS score
32.45%
0%100%
High · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 38 · Related 19DLA-1466-1DLA-1529-1DLA-1715-1MGASA-2018-0391MGASA-2018-0418MGASA-2018-0419RHSA-2018:2785RHSA-2018:2791RHSA-2018:2846RHSA-2018:2924RHSA-2018:2925RHSA-2018:2933RHSA-2018:2948RHSA-2018:3083RHSA-2018:3096RHSA-2018:3459RHSA-2018:3540RHSA-2018:3586RHSA-2018:3590SUSE-SU-2018:2344-1SUSE-SU-2018:2344-2SUSE-SU-2018:2374-1SUSE-SU-2018:2380-1SUSE-SU-2018:2381-1SUSE-SU-2018:2450-1SUSE-SU-2018:2596-1SUSE-SU-2018:3787-1SUSE-SU-2018:3865-1SUSE-SU-2018:3880-1SUSE-SU-2019:0541-1SUSE-SU-2019:0645-1SUSE-SU-2019:0672-1SUSE-SU-2019:1289-1USN-3740-1USN-3740-2USN-3741-1USN-3741-2USN-3742-1
Timeline
- 06-09-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.
CVSS metrics
5 scores · 3 sources · 3 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesSingle source
High 7.8Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:CSourcesSingle source
EPSS trend
Probability
32.45%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 32.45% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Siemens22 products
- ruggedcom_rm1224_firmware< 6.1
- ruggedcom_rox_ii_firmware< 2.13.3
- scalance_m-800_firmware< 6.1
- scalance_s615_firmware< 6.1
- scalance_sc-600_firmware< 2.0
Suse22 products
- kernel-livepatch-SLE15_Update_1&distro=SUSE Linux Enterprise Live Patching 15< 6-2.1
- kernel-livepatch-SLE15_Update_2&distro=SUSE Linux Enterprise Live Patching 15< 6-2.1
- kgraft-patch-SLE12-SP2_Update_18&distro=SUSE Linux Enterprise Server 12 SP2-LTSS< 9-2.1
- kgraft-patch-SLE12-SP2_Update_18&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2< 9-2.1
- kgraft-patch-SLE12-SP2_Update_19&distro=SUSE Linux Enterprise Server 12 SP2-LTSS< 9-2.1
Ubuntu18 products
- linux< 3.13.0-155.205 | < 4.4.0-133.159 | < 4.15.0-32.35
- linux-aws< 4.4.0-1027.30 | < 4.4.0-1065.75 | < 4.15.0-1019.19
- linux-azure< 4.15.0-1021.21~16.04.1 | < 4.15.0-1021.21
- linux-azure-fdeAll versions (No fix recorded)
- linux-euclid< 4.4.0-9029.31
F513 products
- big-ip_access_policy_manager≥ 11.5.1, < 11.6.5.1 | ≥ 12.1.0, < 12.1.5 | ≥ 13.0.0, < 13.1.3 | ≥ 14.0.0, < 14.0.1.1 | ≥ 14.1.0, < 14.1.2.4
- big-ip_advanced_firewall_manager≥ 11.5.1, < 11.6.5.1 | ≥ 12.1.0, < 12.1.5 | ≥ 13.0.0, < 13.1.3 | ≥ 14.0.0, < 14.0.1.1 | ≥ 14.1.0, < 14.1.2.4
- big-ip_analytics≥ 11.5.1, < 11.6.5.1 | ≥ 12.1.0, < 12.1.5 | ≥ 13.0.0, < 13.1.3 | ≥ 14.0.0, < 14.0.1.1 | ≥ 14.1.0, < 14.1.2.4
- big-ip_application_acceleration_manager≥ 11.5.1, < 11.6.5.1 | ≥ 12.1.0, < 12.1.5 | ≥ 13.0.0, < 13.1.3 | ≥ 14.0.0, < 14.0.1.1 | ≥ 14.1.0, < 14.1.2.4
- big-ip_application_security_manager≥ 11.5.1, < 11.6.5.1 | ≥ 12.1.0, < 12.1.5 | ≥ 13.0.0, < 13.1.3 | ≥ 14.0.0, < 14.0.1.1 | ≥ 14.1.0, < 14.1.2.4
Microsoft7 products
- windows_10na | 1607 | 1703 | 1709 | 1803
- windows_7na
- windows_8.1na
- windows_rt_8.1na
- windows_server_2008na | r2:sp1
Redhat6 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus6.4 | 6.5 | 6.6 | 7.2 | 7.3 | 7.4
- enterprise_linux_server_eus6.7 | 7.3 | 7.4 | 7.5
- enterprise_linux_server_tus6.6 | 7.2 | 7.3 | 7.4
Debian2 products
- linux< 4.9.110-3+deb9u2 | < 4.17.15-1
- debian_linuxEOL8.0 | 9.0
Linux2 products
- kernel≥ 3.9, < 3.9*
- linux_kernel≥ 3.9, ≤ 4.18
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04
9 vendors · 93 products
References
49 linksShow all 49 references
lists.debian.org/debian-lts-announce/2018/08/msg00014.htmlMailing ListX Refsource MLISTMitigationThird Party Advisory- www.debian.org/security/2018/dsa-4272Vendor AdvisoryX Refsource DEBIANMitigationThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/03/msg00017.htmlMailing ListX Refsource MLISTThird Party Advisory
- www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-linux-enX Refsource CONFIRMBroken Link