CVE-2014-0100

High

Published: 11/03/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

A race condition in the inet_frag_intern function in the Linux kernel through version 3.13.6 allows remote attackers to cause a use-after-free error or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with heavy CPU load.

Risk Assessment

Attackers may cause system crashes leading to denial of service. Additionally, other unspecified impacts may affect the stability and security of the system.

Recommendation

It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability. Network traffic should also be monitored for potential attacks exploiting this flaw.

Other vulnerabilities in Linux kernel (versions up to 3.13.6)

CVE-2014-2523High
In the Linux kernel up to version 3.13.6, there is a flaw in net/netfilter/nf_conntrack_proto_dccp.c that incorrectly uses a DCCP header pointer. This can lead to a system crash or potentially allow arbitrary code execution via a malicious DCCP packet.

Original NVD description (English source)

Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load.