CVEvulnerability

CVE-2018-6922

5.3 MEDIUM Published 2018-08-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-08-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-400

Description

One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p10 uses an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the number of segments in the reassembly queue. An attacker who has the ability to send TCP traffic to a victim system can degrade the victim system's network performance and/or consume excessive CPU by exploiting the inefficiency of TCP reassembly handling, with relatively small bandwidth cost.

Affected configurations

• freebsd freebsd 10.4 • freebsd freebsd 11.1 • freebsd freebsd 11.2

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References