What’s Vulnerable › Vulnerabilities

CVE-2018-5803

• Severity: medium (CVSS 5.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-06-12 · updated 2026-06-17
• Weakness: CWE-20

Description

In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be exploited to cause a kernel crash.

Affected products

• Debian Linux: 7.0, 8.0, 9.0
• Linux kernel: before 3.2.102; from 3.3 before 4.1.51; from 4.3 before 4.9.87; from 4.10 before 4.14.25; from 4.15 before 4.15.8 — fixed in 3.2.102, 4.1.51, 4.14.25, 4.15.8, 4.9.87
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Workstation: 7.0
• RedHat Virtualization Host: 4.0

How to fix

Upgrade to a fixed version: Linux kernel 3.2.102, 4.1.51, 4.14.25, 4.15.8. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2018:1854
• https://access.redhat.com/errata/RHSA-2018:2948
• https://access.redhat.com/errata/RHSA-2018:3083
• https://access.redhat.com/errata/RHSA-2018:3096
• https://access.redhat.com/errata/RHSA-2019:0641
• https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.102
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.51
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.25
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.8
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.121
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.87
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=07f2c7ab6f8d0a7e7c5764c4e6cc9c52951b9d9c

Get alerted when CVE-2018-5803 or the next vulnerability affects your stack