SB2018100122 - Ubuntu update for linux, linux-aws, linux-kvm and more

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018100122

SB2018100122 - Ubuntu update for linux, linux-aws, linux-kvm and more

Published: October 1, 2018 Updated: October 31, 2026

Security Bulletin ID SB2018100122
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 11% Low 89%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2017-18216)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to the affected software does not use the subsystem.su_mutex component while accessing an item->ci_parent. A local attacker can trigger NULL pointer dereference in in the fs/ocfs2/cluster/nodemanager.c source code file cause the service to crash.

2) Double-free memory error (CVE-ID: CVE-2018-10902)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to double-free memory error in snd_rawmidi_input_params() and snd_rawmidi_output_status() in 'rawmidi.c'. A local attacker can gain elevated privileges and execute arbitrary code.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) Stack-based buffer overflow (CVE-ID: CVE-2018-14633)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing client digest packets in chap_server_compute_md5() function when processing authentication request from an ISCSI initiator. A remote attacker can send an overly long value (longer than 32 bytes), trigger stack-based buffer overflow and execute arbitrary code on the target system.

4) Input validation error (CVE-ID: CVE-2018-15572)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the spectre_v2_parse_cmdline() and pr_info() functions in arch/x86/kernel/cpu/bugs.c. A local user can gain access to sensitive information.


5) Information disclosure (CVE-ID: CVE-2018-15594)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an adjacent attacker to conduct Spectre version 2 (Spectre-v2) attacks.

The vulnerability exists in the arch/x86/kernel/paravirt.c source code file due to improper handling of indirect calls to CALLEE_SAVE paravirtual functions. A remote attacker can access the system and execute an application that submits malicious input to access sensitive information, which could be used to conduct additional attacks. 


6) Memory corruption (CVE-ID: CVE-2018-16276)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to an out-of-bounds access condition in the yurex_read function, as defined in the drivers/usb/misc/yurex.c source code file. A remote unauthenticated attacker can execute a specially crafted program that submits malicious, trigger memory corruption and gain elevated privileges or cause the service to crash.


7) Use-after-free (CVE-ID: CVE-2018-17182)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in vmacache_flush_all() function in mm/vmacache.c file. A local user can trigger the use-after-free error via certain thread creation, map, unmap, invalidation, and dereference operations and execute arbitrary code on the system with elevated privileges.


8) Memory leak (CVE-ID: CVE-2018-6554)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the irda_bind() function in net/irda/af_irda.c and drivers/staging/irda/net/af_irda.c files in the Linux kernel before 4.17. A local user can cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket.


9) Use-after-free (CVE-ID: CVE-2018-6555)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause denial of service attack or escalate privileges on the system.

The vulnerability exists due to a use-after-free error in irda_setsockopt() function within net/irda/af_irda.c and drivers/staging/irda/net/af_irda.c files when processing data passed to AF_IRDA socket. A local user can trigger a use-after-free error and handle the system unresponsive or execute arbitrary code with elevated privileges.


Remediation

Install update from vendor's website.

References