Vulnerability Name:

CVE-2018-6916 (CCN-139967)

Assigned:2018-03-07
Published:2018-03-07
Updated:2018-03-29
Summary:In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p7, 10.4-STABLE, 10.4-RELEASE-p7, and 10.3-RELEASE-p28, the kernel does not properly validate IPsec packets coming from a trusted host. Additionally, a use-after-free vulnerability exists in the IPsec AH handling code. This issue could cause a system crash or other unpredictable results.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Complete
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-416
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2018-6916

Source: CCN
Type: FreeBSD Security Advisory FreeBSD-SA-18:01.ipsec
ipsec validation and use-after-free

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1040460

Source: XF
Type: UNKNOWN
freebsd-cve20186916-dos(139967)

Source: FREEBSD
Type: Patch, Vendor Advisory
FreeBSD-SA-18:01

Vulnerable Configuration:Configuration 1:
  • cpe:/o:freebsd:freebsd:10.3:p28:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:10.4:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:10.4:p7:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:*:*:*:*:*:*:*:* (Version >= 11.0 and < 11.1)

    • Configuration CCN 1:
  • cpe:/o:freebsd:freebsd:10.0:-:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:10.3:-:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:11.0:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:11.1:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:10.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    freebsd freebsd 10.3 p28
    freebsd freebsd 10.4
    freebsd freebsd 10.4 p7
    freebsd freebsd *
    freebsd freebsd 10.0 -
    freebsd freebsd 10.3 -
    freebsd freebsd 11.0
    freebsd freebsd 11.1
    freebsd freebsd 10.4