FreeBSD FreeBSD
En bref
- Source
- NVD
- EPSS
- EPSS 3.19 % · centile 88 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- freebsd
- Statut NVD
- Modified
Description
One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p10 uses an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the number of segments in the reassembly queue. An attacker who has the ability to send TCP traffic to a victim system can degrade the victim system's network performance and/or consume excessive CPU by exploiting the inefficiency of TCP reassembly handling, with relatively small bandwidth cost.
Faiblesses (CWE)
- CWE-400 — Consommation de ressources non maîtrisée (déni de service)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-18666
- GCVE · GCVE-0-2018-6922
Avis du CERT-FR
- CERTFR-2018-AVI-539 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:freebsd:freebsd:10.4:-:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10.4:p1:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10.4:p3:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10.4:p4:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10.4:p5:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10.4:p6:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10.4:p7:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10.4:p8:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10.4:p9:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.1:-:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.1:p1:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.1:p11:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.1:p2:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.1:p4:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.1:p5:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.1:p6:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.1:p7:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.1:p9:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.2:-:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| FreeBSD · FreeBSD | affected All versions prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, 10.4-RELEASE-p10 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |