Multiple vulnerabilities in Linux Kernel



Published: 2018-08-02 | Updated: 2018-08-07
Risk Low
Patch available YES
Number of vulnerabilities 10
CVE-ID CVE-2018-14611
CVE-2018-10901
CVE-2018-14614
CVE-2018-14613
CVE-2018-14734
CVE-2018-14616
CVE-2018-14610
CVE-2018-14609
CVE-2018-14615
CVE-2018-14612
CWE-ID CWE-416
CWE-264
CWE-476
CWE-125
CWE-120
Exploitation vector Local
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #3 is available.
Public exploit code for vulnerability #4 is available.
Public exploit code for vulnerability #6 is available.
Public exploit code for vulnerability #7 is available.
Public exploit code for vulnerability #8 is available.
Public exploit code for vulnerability #9 is available.
Public exploit code for vulnerability #10 is available.
Vulnerable software
Subscribe
Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains information about 10 vulnerabilities.

1) Use-after-free error

EUVDB-ID: #VU14177

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-14611

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to use-after-free error in the btrfs_check_chunk_valid() function, as defined in the source code file fs/btrfs/volumes.c. A local attacker can mount a specially crafted Btrfs filesystem that submits malicious input, trigger memory corruption in the try_merge_free_space() function and cause the affected software to terminate abnormally or execute arbitrary code with elevated privileges..

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update to version 4.17.11.

Vulnerable software versions

Linux kernel: 4.15 - 4.17.10

External links

http://bugzilla.kernel.org/show_bug.cgi?id=199839


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Privilege escalation

EUVDB-ID: #VU14178

Risk: Low

CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-10901

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability existsin the Kernel-based Virtual Machine (KVM) virtualization subsystem  due to the vmx.c source code file of the affected software fails to set the GDT.LIMIT value to the previous host value and instead sets it to 64 KB. A local attacker can place malicious entries in the Global Descriptor Table (GDT), submit a specially crafted request that submits malicious input and gain elevated privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.15 - 4.17.10

External links

http://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3444d7da1839b851eefedd372978d8a982316c36


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Null pointer dereference

EUVDB-ID: #VU14179

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-14614

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference in the __remove_dirty_segment() function, as defined in the source code file fs/f2fs/inode.c when mounting Flash-Friendly File System (F2FS) images. A local attacker can mount a specially crafted F2FS filesystem that submits malicious input and cause the affected software to terminate abnormally.

Mitigation

Update to version 4.17.11.

Vulnerable software versions

Linux kernel: 4.15 - 4.17.10

External links

http://bugzilla.kernel.org/show_bug.cgi?id=200419


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Null pointer dereference

EUVDB-ID: #VU14180

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-14613

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the check_leaf_item() function, as defined in the source code file fs/btrfs/tree-checker.c, due to the affected software improperly validates block group items. A local attacker can mount and operate a specially crafted Btrfs filesystem that submits malicious input, trigger an invalid pointer dereference error in the io_ctl_map_page() function and cause the affected software to terminate abnormally.

Mitigation

Update to version 4.17.11.

Vulnerable software versions

Linux kernel: 4.15 - 4.17.10

External links

http://bugzilla.kernel.org/show_bug.cgi?id=199849


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Use-after-free error

EUVDB-ID: #VU14181

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14734

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to the ucma_leave_multicast() function, as defined in the drivers/infiniband/core/ucma.c source code file of the affected software, could allow access to a certain data structure after it has been allocated and freed in the ucma_process_join() function. A local attacker can send a specially request that submits malicious input, trigger use-after-free error and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.15 - 4.17.11

External links

http://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cb2595c1393b4a5211534e6f0a0fbad369e21ad8


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Null pointer dereference

EUVDB-ID: #VU14183

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-14616

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference when the fscrypt_do_page_crypto() function, as defined in the fs/crypto/crypto.c source code file of the affected software, operates on a file in a corrupted Flash-Friendly File System (F2FS) image. A local attacker can mount a malicious F2FS image on a targeted system, operat on a file in the image, and cause the software to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.15 - 4.17.10

External links

http://bugzilla.kernel.org/show_bug.cgi?id=200465


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

7) Out-of-bounds read

EUVDB-ID: #VU14186

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-14610

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the write_extent_buffer() function due to insufficient verification that each block group has a corresponding chunk at mount time in the btrfs_read_block_groups()function, as defined in fs/btrfs/extent-tree.c source code file. A local attacker can mount and operate a Btrfs filesystem image that submits malicious input, trigger an out-of-bounds read in the write_extent_buffer() function and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.15 - 4.17.10

External links

http://bugzilla.kernel.org/show_bug.cgi?id=199837


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Null pointer dereference

EUVDB-ID: #VU14185

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-14609

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the __del_reloc_root() function, as defined in the fs/btrfs/relocation.c source code file of the affected software due to an invalid pointer dereference condition that could occur when a corrupted Btrfs filesystem image is mounted. A local attacker can mount a Btrfs image that submits malicious input, trigger an invalid pointer dereference condition and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.15 - 4.17.10

External links

http://bugzilla.kernel.org/show_bug.cgi?id=199833


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

9) Buffer overflow

EUVDB-ID: #VU14202

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-14615

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the truncate_inline_inode() function, as defined in the fs/f2fs/inline.c source code file of the affected software due to a length value may be negative during unmounting operations on a Flash-Friendly File System (F2FS) image. A local attacker can unmount an F2FS image, trigger a buffer overflow condition and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.15 - 4.17.10

External links

http://bugzilla.kernel.org/show_bug.cgi?id=200421


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

10) Null pointer dereference

EUVDB-ID: #VU14201

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-14612

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the btrfs_root_node() function due to insufficient validation of chunk block group mappings in the btrfs_read_block_groups() function (as defined in the fs/btrfs/extent-tree.c source code file of the affected software), as well as insufficient empty-tree checks in the check_leaf() function in the fs/btrfs/tree-checker.c source code file. A local attacker can mount a B-Tree File System (Btrfs) image that submits malicious input, trigger an invalid pointer dereference condition in the btrfs_root_node() function and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.15 - 4.17.10

External links

http://bugzilla.kernel.org/show_bug.cgi?id=199847


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###