Privilege escalation in Linux Kernel

Published: 2018-09-05 18:16:08
Severity Low
Patch available YES
Number of vulnerabilities 1
CVE ID CVE-2018-16276
CVSSv3 6.8 [CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CWE ID CWE-119
Exploitation vector Local
Public exploit N/A
Vulnerable software Linux kernel
Vulnerable software versions Linux kernel 4.17.19
Linux kernel 4.17.18
Linux kernel 4.17.17

Show more

Vendor URL Linux Foundation

Security Advisory

1) Memory corruption

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to an out-of-bounds access condition in the yurex_read function, as defined in the drivers/usb/misc/yurex.c source code file. A remote unauthenticated attacker can execute a specially crafted program that submits malicious, trigger memory corruption and gain elevated privileges or cause the service to crash.

Remediation

Update to version 4.17.7 or later.

External links

https://bugzilla.redhat.com/show_bug.cgi?id=1624507

Back to List