CVE-2007-4567

Status: ModifiedHigh (7.8)—Exploit

Severity7.8High · CVSS 2.0

Exploitation probability14 %higher than 97% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailablePublished on Exploit-DB

The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.22 does not properly validate the hop-by-hop IPv6 extended header, which allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted IPv6 packet.

CVSS

Base score: 7.8
Version: 2.0
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 14 %
Percentile among all scored CVEs: 97
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Published on Exploit-DB · Linux Kernel 2.6.22 - IPv6 Hop-By-Hop Header Remote Denial of Service (12/19/2007)

Affected technologies (1)

Linux — Linux Kernel

CWEs

CWE-20

References

Show 32 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2007-4567",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-12-21T00:46:00.000",
  "references": [
    {
      "url": "http://bugzilla.kernel.org/show_bug.cgi?id=8450",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e76b2b2567b83448c2ee85a896433b96150c92e6",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/25505",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/28170",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/28706",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/38015",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0019.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0053.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/26943",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-574-1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=548641",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39171",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11083",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7474",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2010-0095.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://usn.ubuntu.com/558-1/",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://bugzilla.kernel.org/show_bug.cgi?id=8450",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e76b2b2567b83448c2ee85a896433b96150c92e6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/25505",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28170",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28706",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/38015",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0019.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0053.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/26943",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-574-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=548641",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39171",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11083",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7474",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2010-0095.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://usn.ubuntu.com/558-1/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.22 does not properly validate the hop-by-hop IPv6 extended header, which allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted IPv6 packet."
    },
    {
      "lang": "es",
      "value": "La función ipv6_hop_jumbo en el archivo net/ipv6/exthdrs.c en el kernel de Linux versiones anteriores a 2.6.22, no comprueba apropiadamente el encabezado extendido de IPv6 salto a salto, lo que permite a los atacantes remotos causar una denegación de servicio (desreferencia del puntero NULL y pánico del kernel) por medio de un paquete IPv6 especialmente diseñado."
    }
  ],
  "lastModified": "2026-06-16T22:44:20.560",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D253C55-0E1E-4D3F-B0BB-D59BEC5C5937",
              "versionEndIncluding": "2.6.21.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.2.27:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43F9DBB0-8AF7-42CA-95DD-68A344E9D549"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.4.36:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA39D4CE-22F0-46A2-B8CF-4599675E7D3A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.4.36.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDD00664-A27C-4514-A2A4-079E8F9B0251"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.4.36.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E336C792-B7A1-4318-8050-DE9F03474CEF"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.4.36.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7228AE50-BACB-4AB8-9CE5-17DB0CD661AF"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.4.36.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6D260FD-E55E-4A95-AB7F-B880DBE37BAD"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.4.36.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E36D0159-1A05-4628-9C1C-360DED0F438C"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.4.36.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E6654B9-42EB-4C2C-8F71-710D50556180"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FC560CC-F785-42D5-A25B-1BA02E7AC464"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C06F0037-DE20-4B4A-977F-BFCFAB026517"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.18:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1817C772-D367-4ABE-B835-466D31A6DC89"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.18:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C667B8E4-64EB-4A05-84FF-B2243DEF757D"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.18:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9484B41A-DFB6-4481-80D8-440C711CEA53"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.18:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53D373AF-DE6B-428E-9F0F-F1D220900A4D"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.18:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2975DF7-F916-456C-BF7C-2694559E5282"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.18:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D156EFF-D2E5-4F42-B6E7-954DE6CD90B4"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.18:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "784EB96E-2FD3-4F77-8DB6-4D6C7A928946"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.19.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86A98A70-51E3-4556-8DC4-DD09CF370D1A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.19.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "469EE3B0-3CC2-4AC2-86A0-2DF34205E707"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.19.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCFECB2B-6482-45F2-B3BB-EDDEDA0948A0"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.19.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EC547EB-9308-4477-8256-A0E04B42D6DA"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.20.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F55A024-9F8E-44F8-A0D8-696BC232524A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.20.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84595143-3B04-4CE8-81C0-28EEEC58CD0E"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.20.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32EE2B49-DDEB-4B49-A5F0-CAA161095A5F"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.20.19:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3ABFA33-8FA1-488E-A9BD-1593F495F595"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.20.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62F6DE3A-E6CC-4D7E-BD08-E43DC4182200"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.20.21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9A29C44-EBE5-42B0-AFAD-C5A8F6EEF2F8"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.21.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96A43C95-8569-40BE-9E5B-F9B3D0B9D188"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.21.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABD70B2B-9827-4DBB-B82D-0B70C2D4AB1F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and Red Hat Enterprise MRG. Shipped kernels do not include upstream commit a11d206d that introduced the problem.\n\nThis upstream commit was backported in Red Hat Enterprise Linux 5 via RHBA-2008:0314. It was reported and addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2010-0019.html",
      "lastModified": "2010-01-21T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}