Description
The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.11.7-1 | — |
| Debian 13 | linux | 3.11.7-1 | — |
| Debian 12 | linux | 3.11.7-1 | — |
| Debian 6.0 | linux-2.6 | 2.6.32-48squeeze8 | DLA-0015-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +15 | 2.6.32-431.1.2.el6 | RHSA-2013:1801 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6.4 EUS | perf +14 | 2.6.32-358.37.1.el6 | RHSA-2014:0284 |
| Red Hat MRG 2 | kernel-rt +10 | 3.8.13-rt27.33.el6rt | RHSA-2014:0100 |
Advisories 4
- RHSA-2014:0284 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:1801 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DLA-0015-1 linux-2.6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2014:0100 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b
- [oss-security] 20131025 Re: CVE request: Linux kernel: net: memory corruption with UDP_CORK and UFO mailing-list
- USN-2043-1 vendor-advisory
- USN-2073-1 vendor-advisory
- USN-2040-1 vendor-advisory
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.12.bz2
- USN-2069-1 vendor-advisory
- USN-2044-1 vendor-advisory
- RHSA-2013:1801 vendor-advisory
- USN-2066-1 vendor-advisory
- SUSE-SU-2014:0459 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1023477
- https://github.com/torvalds/linux/commit/c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b
- USN-2049-1 vendor-advisory
- RHSA-2014:0284 vendor-advisory
- 63359 vdb-entry
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e93b7d748be887cd7639b113ba7d7ef792a7efb9
- USN-2050-1 vendor-advisory
- USN-2042-1 vendor-advisory
- https://github.com/torvalds/linux/commit/e93b7d748be887cd7639b113ba7d7ef792a7efb9
- RHSA-2014:0100 vendor-advisory
- USN-2067-1 vendor-advisory
- USN-2046-1 vendor-advisory