IBM has announced a release for IBM Security Identity Governance and Intelligence (IGI) in response to security vulnerability. A vulnerability in the Linux kernel, included in IBM Security Identity Governance and Intelligence (IGI), affects the way the Linux kernel handles reassembly of fragmented IPv4 and IPv6 packets. By sending specially crafted IP fragments with random offsets, a remote attacker could exploit this vulnerability to exhaust all available CPU resources and cause a denial of service.
CVEID: CVE-2018-5391 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by the improper handling of the reassembly of fragmented IPv4 and IPv6 packets by the IP implementation. By sending specially crafted IP fragments with random offsets, a remote attacker could exploit this vulnerability to exhaust all available CPU resources and cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/148388> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
IBM Security Identity Governance and Intelligence (IGI) 5.2.4, 5.2.4.1
Product Name
| VRMF | First Fix
—|—|—
IGI | 5.2.4 | 5.2.5.0-ISS-SIGI-FP0000
IGI | 5.2.4.1 | 5.2.5.0-ISS-SIGI-FP0000
None