Home / Security / Advisories / NTAP-20180815-0002

NTAP-20180815-0002 — CVE-2018-6922 FreeBSD Denial of Service (DoS) Vulnerability in NetApp Products

Published 2018-08-15 · Updated 2018-11-09 · Status: Final · Exploitation: Public · Severity: MEDIUM 5.3 · ONTAP affected: Yes

Official advisory: NTAP-20180815-0002 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: ONTAP | ONTAP-relevant | highest CVSS: 5.3

CVEs in this advisory

CVE-2018-6922 — MEDIUM · CVSS 5.3 · site index

What the CVE records say

CVE-2018-6922 — One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p10 uses an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the number of segments in the reassembly queue. An attacker who has the ability to send TCP traffic to a victim system can degrade the victim system's network performance and/or consume excessive CPU by exploiting the inefficiency of TCP reassembly handling, with relatively small bandwidth cost.

Impact

Successful exploitation of this vulnerability may allow a remote attacker cause Denial of Service (DoS).

Affected products

Clustered Data ONTAP

Official fixes

Clustered Data ONTAP — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗

References

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.