VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel.
Advisory: CVE-2018-14641
Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2018-14641
CVSS severity score: 7.1/10.0
Description:
A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive, which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial-of-service.
This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.
Comment 1 by groeck@chromium.org
, Nov 28Labels: Security_Severity-High Security_Impact-None Pri-3
Owner: groeck@chromium.org
Status: WontFix (was: Untriaged)
Fixed with commit 5d407b071dc369c ("ip: frags: fix crash in ip_do_fragment()"). As per description, no release images are affected by this problem. Marking as WontFix.