CVE-2019-11683

Published: 2 May 2019

udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x before 5.0.13 allows remote attackers to cause a denial of service (slab-out-of-bounds memory corruption) or possibly have unspecified other impact via UDP packets with a 0 payload, because of mishandling of padded packets, aka the "GRO packet of death" issue.

From the Ubuntu security team

It was discovered that the IPv4 generic receive offload (GRO) for UDP implementation in the Linux kernel did not properly handle padded packets. A remote attacker could use this to cause a denial of service (system crash).

Notes

The receiving socket has to have the UDP_GRO socket option explicitly
enabled with a call to setsockopt(2). UDP sockets are not vulnerable to this
attack by default.

Priority

Medium

CVSS 3 base score: 9.8

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11683
• http://www.openwall.com/lists/oss-security/2019/05/02/1
• https://git.kernel.org/linus/4dd2b82d5adfbe0b1587ccad7a8f76d826120f37
• https://www.spinics.net/lists/netdev/msg568315.html
• https://ubuntu.com/security/notices/USN-3979-1
• NVD
• Launchpad
• Debian