Back
CVE-2018-6918
In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option…
High7.5EPSS 4.2%
- Published
- Updated
- Reserved
- Assigned by
- freebsd
Description
In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 4.2% · top 9.0% of all CVEs (3 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
- Kernel crash or denial of service
- CWE-835 (opens in a new tab)All about CWE-835 and its CVEs
Affected products
References (7)
- 1040628 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
- FreeBSD-SA-18:05 (opens in a new tab)vendor-advisoryx_refsource_FREEBSDx_transferred
- 103666 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://support.apple.com/kb/HT210090 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 20190531 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1 (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 20190611 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- https://support.apple.com/kb/HT210091 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2018-6918)Record last updated .