Memory leak in Linux kernel - CVE-2018-7757

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU10927

Memory leak in Linux kernel - CVE-2018-7757

Published: March 9, 2018 / Updated: March 20, 2018


Vulnerability identifier: #VU10927
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-7757
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the drivers/scsi/libsas/sas_expander.c source code in the sas_smp_get_phy_events function due to memory leak. A local attacker can trigger memory corruption and cause the system to crash.

Affected software

Linux kernel
Debian Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
SUSE Linux
Fedora
Opensuse
ffmpeg (Alpine package)
kernel-alt (Red Hat package)
kernel

How to mitigate CVE-2018-7757

Install update from vendor's website.

ffmpeg (Alpine package) - update to 4.1-r0
kernel-alt (Red Hat package) - update to 4.14.0-115.el7a
kernel - update to 4.15.8-300.fc27

External References

Related Security Bulletins