CVE-2013-4563

The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline.

• CWE-189

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0e033e04c2678dbbe74a46b23fffb7bb918c288eVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2013/11/13/9Mailing List, Patch
• http://www.ubuntu.com/usn/USN-2113-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2117-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1030015Issue Tracking
• https://github.com/torvalds/linux/commit/0e033e04c2678dbbe74a46b23fffb7bb918c288eExploit, Patch
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0e033e04c2678dbbe74a46b23fffb7bb918c288eVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2013/11/13/9Mailing List, Patch
• http://www.ubuntu.com/usn/USN-2113-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2117-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1030015Issue Tracking
• https://github.com/torvalds/linux/commit/0e033e04c2678dbbe74a46b23fffb7bb918c288eExploit, Patch

Published

Nov 20, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4557The Security Screen (_core_/securite/ecran_securite.php) bef…
• CVE-2013-4558The get_parent_resource function in repos.c in mod_dav_svn A…
• CVE-2013-4559lighttpd before 1.4.33 does not check the return value of th…
• CVE-2013-4560Use-after-free vulnerability in lighttpd before 1.4.33 allow…
• CVE-2013-4561In a openshift node, there is a cron job to update mcollecti…9.1
• CVE-2013-4562The omniauth-facebook gem 1.4.1 before 1.5.0 does not proper…
• CVE-2013-4564Libreswan 3.6 allows remote attackers to cause a denial of s…
• CVE-2013-4565Heap-based buffer overflow in the __OLEdecode function in pp…
• CVE-2013-4566mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to no…
• CVE-2013-4567Incomplete blacklist vulnerability in Sanitizer::checkCss in…
• CVE-2013-4568Incomplete blacklist vulnerability in Sanitizer::checkCss in…
• CVE-2013-4569The CleanChanges extension for MediaWiki before 1.19.9, 1.20…