Fedora 28 update for kernel, kernel-headers, kernel-tools
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2018-19406 CVE-2018-19824 |
| CWE-ID | CWE-476 CWE-416 |
| Exploitation vector | Local |
| Public exploit | Public exploit code for vulnerability #2 is available. |
| Vulnerable software |
Fedora Operating systems & Components / Operating system kernel-tools Operating systems & Components / Operating system package or component kernel-headers Operating systems & Components / Operating system package or component kernel Operating systems & Components / Operating system package or component |
| Vendor | Fedoraproject |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Null pointer dereference
EUVDB-ID: #VU16021
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-19406
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists in the kvm_pv_send_ipi function, as defined in the arch/x86/kvm/lapic.c source code file due to the failure of the Advanced Programmable Interrupt Controller (APIC) map to initialize. A local attacker can access the system and execute an application that submits malicious system calls, trigger a NULL pointer dereference, which could result in a DoS condition.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsFedora: 28
kernel-tools: before 4.19.7-200.fc28
kernel-headers: before 4.19.7-200.fc28
kernel: before 4.19.7-200.fc28
CPE2.3- cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:kernel-tools:*:*:*:*:*:fedora:*:*
- cpe:2.3:a:fedoraproject:kernel-headers:*:*:*:*:*:fedora:*:*
- cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a0914af224
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Use-after-free error
EUVDB-ID: #VU16237
Risk: Low
CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2018-19824
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists in the Advanced Linux Sound Architecture (ALSA) driver due to use-after-free error in the usb_audio_probefunction, as defined in the sound/usb/card.c source code file. A local attacker can supply a malicious USB sound device with no interfaces, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsFedora: 28
kernel-tools: before 4.19.7-200.fc28
kernel-headers: before 4.19.7-200.fc28
kernel: before 4.19.7-200.fc28
CPE2.3- cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:kernel-tools:*:*:*:*:*:fedora:*:*
- cpe:2.3:a:fedoraproject:kernel-headers:*:*:*:*:*:fedora:*:*
- cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a0914af224
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
