CVE-2014-0100

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-03-11 · updated 2026-06-17
Weakness: CWE-362

Description

Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load.

Affected products

Linux kernel: from 3.9 before 3.10.37; from 3.11 before 3.12.18; from 3.13 before 3.13.10 — fixed in 3.10.37, 3.12.18, 3.13.10

How to fix

Upgrade to a fixed version: Linux kernel 3.10.37, 3.12.18, 3.13.10. Check the vendor advisory for mitigations.

References

http://patchwork.ozlabs.org/patch/325844/
http://www.openwall.com/lists/oss-security/2014/03/04/4
https://bugzilla.redhat.com/show_bug.cgi?id=1070618
http://patchwork.ozlabs.org/patch/325844/
http://www.openwall.com/lists/oss-security/2014/03/04/4
https://bugzilla.redhat.com/show_bug.cgi?id=1070618

Get alerted when CVE-2014-0100 or the next vulnerability affects your stack