Microsoft CVE-2018-5391: Windows Denial of Service Vulnerability
Description
Microsoft is aware of a denial of service vulnerability (named "FragmentSmack" CVE-2018-5391) affecting Windows systems. An attacker could send many 8-byte sized IP fragments with random starting offsets, but withhold the last fragment and exploit the worst-case complexity of linked lists in reassembling IP fragments. A system under attack would become unresponsive with 100% CPU utilization but would recover as soon as the attack terminated. Recommended actions To protect your system from this vulnerability, Microsoft recommends that you take the following actions: Register for security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications. Test and apply security updates. See the Affected Products table to download and install the updates. If you cannot apply the security updates immediately, you can apply the workaround described in FAQ #1. FAQ 1. What workaround(s) exist for this vulnerability? The following commands disable packet reassembly. Any out-of-order packets are dropped. There is a potential for packet loss when discarding out-of-order packets. Valid scenarios should not exceed more than 50 out-of-order fragments. We recommend testing prior to updating production systems. Netsh int ipv4 set global reassemblylimit=0 Netsh int ipv6 set global reassemblylimit=0 Further netsh guidance can be found at netsh. 2. Is Azure affected? Azure fabric layer protections mitigate this vulnerability. This is blocked before traffic reaches Azure VMs. 3. What can I do at the perimeter to block this attack? Review the perimeter device guidance and modify reassembly packet limits similar to the commands listed in FAQ #1.
Solution(s)
- msft-kb4457128-92d4e1f4-716c-4d0c-adaf-544d7f4b243d
- msft-kb4457128-e3bcb87c-3e55-4ed7-8db0-d9598c929a11
- msft-kb4457128-eab1a4bc-7207-4730-9370-a5869908cd56
- msft-kb4457131-63f3e344-cffe-429b-b500-7cc484679f93
- msft-kb4457131-8dfcb13a-222e-4a1e-a380-941f9ab2e8d0
- msft-kb4457131-bdbbf843-3f15-4f52-af21-9d426dc974c5
- msft-kb4457132-87da0526-3624-42d2-81bd-0b69fc9c27d8
- msft-kb4457132-96717121-b1a3-4e91-abb5-18b89d194205
- msft-kb4457138-ad2fa7b5-120d-4068-9cbc-92f157d7cee9
- msft-kb4457138-f34cdc38-7598-4cc2-a264-4e06194a32de
- msft-kb4457140-5d75b1e9-f821-4b17-89c6-40d7e6b24ca7
- msft-kb4457140-85371836-4e06-4f05-a56d-d6182fe3540c
- msft-kb4457140-8ece9dfe-0271-4997-b596-5d8651d37416
- msft-kb4457142-9b51afc7-4b07-4a96-8bd4-355d5b246004
- msft-kb4457142-cdc6a0ee-255d-41b1-be04-1fd7517d5b5f
- msft-kb4457142-e510dc03-b10b-49f6-bfb6-33c1f3ed45fb
- msft-kb4457143-175a0d78-90dc-45c3-baf2-1c2cc20168a9
- msft-kb4457143-3f52105e-8bb6-4180-ba02-bf0798bb670c
- msft-kb4457143-b4e784a4-9907-4d25-90ef-858bcafcf450
- msft-kb4457145-3476b964-fc89-4bdb-abe7-186990e49877
- msft-kb4457145-5ea03284-2bc0-46e2-96ea-cb2175514dbd
- msft-kb4457145-c3ffc65f-5934-48e9-9dae-1004d041e764
- msft-kb4457145-db4fc522-1d10-4af9-8d16-79658ada76b8
- msft-kb4457145-e69e8c03-c176-42b7-b39d-717ed70c8cac
- msft-kb4457145-ffe4c6ea-4545-4a21-9334-17496e869569
- msft-kb4457984-12dff458-a5cd-4d6c-97a2-6c34345ae073
- msft-kb4457984-99218fd4-d475-4f9b-8b7e-23771f47c86b
- msft-kb4457984-a944dea7-38fb-4233-95df-96ac1c73dc67
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center