CVE: CVE-2018-5391: kernel: IP fragment re-assembly allows DOS (FragmentSmack)

[Ghada Khalil]

Brief Description
-----------------
The StarlingX kernel is vulnerable to CVE-2018-5391: kernel: IP fragment re-assembly allows DOS (FragmentSmack)
https://nvd.nist.gov/vuln/detail/CVE-2018-5391

The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.

CVSS v2: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)

https://access.redhat.com/errata/RHSA-2018:3083
https://lists.centos.org/pipermail/centos-cr-announce/2018-November/005315.html

Required kernel version: kernel-3.10.0-957.el7.src.rpm

Severity
--------
Major. CVSS v2: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)

Steps to Reproduce
------------------
N/A

Expected Behavior
------------------
N/A

Actual Behavior
----------------
N/A

Reproducibility
---------------
Reproducible

System Configuration
--------------------
Any

Branch/Pull Time/Commit
-----------------------
any

Timestamp/Logs
--------------
N/A

[Cindy Xie (xxie1)]

Storyboard has been created for kernel upgrade: https://storyboard.openstack.org/#!/story/2004521
once the storbyboard implemented, we can make this launchpad as fixed.

[Lin Shuicheng (shuicheng)]

Hi all,
We meet issue with upgrade kernel to 957 version. It will cause several modules build failure, due to data structure/function api change in kernel.
here is the module list which has build issue with 957 kernel:
Mlnx-ofa_kernel
Intel-i40e
Intel-i40evf
Tpmdd
Intel-ixgbe
drbd
openvswitch

Another thing is based on info in below link, Redhat has an updated kernel srpm to fix this CVE issue for CentOS 7.5:
https://access.redhat.com/errata/RHSA-2018:3459
For this srpm kernel-3.10.0-862.20.2.el7.src.rpm, I cannot find it in CentOS repo, or online yet.
But I suppose CentOS should also have it soon?

So I suggest we fix this CVE issue in master with this 862 kernel after it is available.
And 957 kernel upgrade will be done as part of CentOS 7.6 upgrade in feature branch.
Thanks.

[Brent Rowsell (brent-rowsell)]

CentOS generally only publishes the latest kernel so it is unlikely there will be a 860.20.2 kernel available. As part of moving to 7.6 the work to move to the 957 kernel has to be done anyway.

[Lin Shuicheng (shuicheng)]

Kernel has been upgraded in centos76 feature branch. We could close this issue after feature branch code merge back to master.