vulnwire
7.5high

CVE-2018-6918

In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option hea…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.2%
percentile 91%
Public exploits
0
none known

In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash.

Exploit prediction (EPSS)

4.21% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.07.8AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

  • FreeBSD FreeBSD

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

  • securitytracker.com /id/1040628 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • security.freebsd.org /advisories/FreeBSD-SA-18:05.ipsec.asc · vendor-advisory, x_refsource_FREEBSD, x_transferred
  • securityfocus.com /bid/103666 · vdb-entry, x_refsource_BID, x_transferred
  • support.apple.com /kb/HT210090 · x_refsource_CONFIRM, x_transferred
  • seclists.org /bugtraq/2019/May/77 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • seclists.org /fulldisclosure/2019/Jun/6 · mailing-list, x_refsource_FULLDISC, x_transferred
  • support.apple.com /kb/HT210091 · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.