Improper input validation in Linux kernel - CVE-2018-1000026

Vulnerability identifier: #VU10925

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000026

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists in the bnx2x network card driver due to insufficient validation of user-supplied input. A remote attacker can submit a specially crafted packet to the affected network card and cause the system to crash.

Linux kernel
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
SUSE Linux
Fedora
kernel-alt (Red Hat package)
kernel

Install update from vendor's website.

Linux kernel - addressed in versions 4.9.159, 4.14.102
kernel-alt (Red Hat package) - update to 4.14.0-115.el7a
kernel - addressed in versions 4.15.4-200.fc26, 4.15.4-300.fc27

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8914a595110a6eca69a5e2...
• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.159
• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.102

• Denial of service in Linux Kernel
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• OpenSUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• Fedora 27 update for kernel
• Fedora 26 update for kernel
• Red Hat Enterprise Linux 7 update for kernel-alt