CVE-2013-4563

The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline.

CVSS v2.0 7.1 HIGH

7.1^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:C

Exploitability : 8.6 / Impact : 6.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0e033e04c2678dbbe74a46b23fffb7bb918c288e	Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/11/13/9	Mailing List Patch
http://www.ubuntu.com/usn/USN-2113-1	Third Party Advisory
http://www.ubuntu.com/usn/USN-2117-1	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1030015	Issue Tracking
https://github.com/torvalds/linux/commit/0e033e04c2678dbbe74a46b23fffb7bb918c288e	Exploit Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::
	cpe:2.3:o:canonical:ubuntu_linux:13.10:::::::*

History

No history.

Information

Published : 2013-11-20 13:19

Updated : 2023-05-19 16:50

NVD link : CVE-2013-4563

Mitre link : CVE-2013-4563

CVE.ORG link : CVE-2013-4563

JSON object : View

Products Affected

canonical

ubuntu_linux

linux

linux_kernel

CWE

CWE-189

Numeric Errors

{"id": "CVE-2013-4563", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-11-20T13:19:41.697", "references": [{"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0e033e04c2678dbbe74a46b23fffb7bb918c288e", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2013/11/13/9", "tags": ["Mailing List", "Patch"], "source": "secalert@redhat.com"}, {"url": "http://www.ubuntu.com/usn/USN-2113-1", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.ubuntu.com/usn/USN-2117-1", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1030015", "tags": ["Issue Tracking"], "source": "secalert@redhat.com"}, {"url": "https://github.com/torvalds/linux/commit/0e033e04c2678dbbe74a46b23fffb7bb918c288e", "tags": ["Exploit", "Patch"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-189"}]}], "descriptions": [{"lang": "en", "value": "The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline."}, {"lang": "es", "value": "La funci\u00f3n udp6_ufo_fragment en net/ipv6/udp_offload.c del kernel de Linux hasta la versi\u00f3n 3.12, cuando est\u00e1 activado UDP Fragmentation Offload (UFO), no realiza adecuadamente comparaciones de cierto tama\u00f1o antes de insertar una cabecera fragmentada, lo que permite a atacantes remotos provocar una denegaci\u00f3n de servicio (panic) a trav\u00e9s de un paquete IPv6 UDP grande, tal y como se demostr\u00f3 mediante el uso de Token Bucket Filter (TBF)."}], "lastModified": "2023-05-19T16:50:53.503", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E06431E-08C2-49B3-9479-9E506C545BD5", "versionEndIncluding": "3.10.23", "versionStartIncluding": "3.9.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98872EEB-8D10-4CF6-9592-F9CE1090365D", "versionEndExcluding": "3.12.4", "versionStartIncluding": "3.11"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "CB66DB75-2B16-4EBF-9B93-CE49D8086E41"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F61F047-129C-41A6-8A27-FFCBB8563E91"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}