{"id":"CVE-2018-5391","published":"2018-09-06T21:00:00Z","modified":"2024-08-05T05:33:44Z","title":"The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of…","vendor":"Linux","product":"Kernel","tier":"core","eol":null,"affectedVersions":[{"vendor":"Linux","product":"Kernel","versions":[">= 3.9, < 3.9*"]}],"description":{"text":"The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Linux kernel (versions 3.9 and later) has a flaw in its IP implementation's fragment re-assembly logic, which handles incoming IP fragments. An attacker who sends specially crafted IP fragments at low rates can exhaust resources and cause a denial of service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:18Z"},"cvss":null,"epss":{"score":0.32445,"percentile":0.9833,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2020-02-25","exploitedFirstSeen":"2020-02-25","ransomware":true,"evidence":[{"url":"https://www.csk.gov.in/alerts/STOP_ransomware.html","date":"2020-02-25"},{"url":"https://cybersecurityworks.com/pdf/ransomware/Spotlight_Ransomware2021.pdf","date":"2021-02-11"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf","date":"2022-05-18"},{"url":"https://www.ivanti.com/resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3","date":"2022-10-21"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:3540","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2785","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3083","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2925","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.kb.cert.org/vuls/id/641765","tags":["third-party-advisory","x_refsource_CERT-VN"]},{"url":"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txt","tags":["x_refsource_CONFIRM"]},{"url":"https://usn.ubuntu.com/3741-2/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securitytracker.com/id/1041476","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3459","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=c30f1fc041b74ecdb072dd44f858750414b8b19f","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2933","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://usn.ubuntu.com/3740-2/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://usn.ubuntu.com/3741-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3590","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2948","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://usn.ubuntu.com/3742-2/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://usn.ubuntu.com/3740-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securityfocus.com/bid/105108","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/08/msg00014.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://usn.ubuntu.com/3742-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2924","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.debian.org/security/2018/dsa-4272","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3586","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2846","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securitytracker.com/id/1041637","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3096","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2791","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://security.netapp.com/advisory/ntap-20181003-0002/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/28/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2019/07/06/3","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2019/07/06/4","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://support.f5.com/csp/article/K74374841?utm_source=f5support&amp%3Butm_medium=RSS","tags":["x_refsource_CONFIRM"]},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-linux-en","tags":["x_refsource_CONFIRM"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-377115.pdf","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-17161","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-17161","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-09-11","earliestUrl":"https://github.com/zeinabmazraani/OverlapCraft","repos":[{"name":"zeinabmazraani/OverlapCraft","url":"https://github.com/zeinabmazraani/OverlapCraft","stars":0,"created":"2026-09-11"}]},"first":{"date":"2026-09-11","source":"PoC-in-GitHub","url":"https://github.com/zeinabmazraani/OverlapCraft"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2018-09-06","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-5391","provenance":"source"},{"date":"2020-02-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.csk.gov.in/alerts/STOP_ransomware.html","provenance":"source"},{"date":"2026-09-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/zeinabmazraani/OverlapCraft","provenance":"source"}],"speed":{"daysToPublicExploit":2927,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":69.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2439 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.67,"detail":"percentile 0.9833"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}