SB2018102505 - Privilege escalation in Linux Kernel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018102505

SB2018102505 - Privilege escalation in Linux Kernel

Published: October 25, 2018

Security Bulletin ID SB2018102505
Severity
Low
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Privilege escalation (CVE-ID: CVE-2018-18559)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to improper handling of a certain multithreaded case involving packet_do_bind unregister and packet_notifier register actions after a race condition between fanout_add, from setsockopt, and a bind on an AF_PACKET socket. A local attacker can execute a program or file that submits malicious input, trigger a use-after-free condition and execute arbitrary code with kernel privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References