Integer overflow in GNU C Library (glibc) - CVE-2018-6551

Vulnerability identifier: #VU11549

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-6551

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists in the malloc implementation due to improper handling of malloc calls with arguments close to SIZE_MAX and returning a pointer to a heap region that is smaller than requested. A remote attacker can gain root privileges.

GNU C Library (glibc)
Gentoo Linux
SUSE Linux
Fedora
Dynamic System Analysis (DSA) Preboot
Integrated Management Module II (IMM2) for BladeCenter Systems
System x Integrated Management Module (IMM2)
Flex System Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)
glibc

Update to version 2.27.

Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
System x Integrated Management Module (IMM2) - update to 1AOO84C-6.80
Flex System Integrated Management Module (IMM2) - update to 1AOO84C-6.80
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO84C-6.80-bc
Flex System Chassis Management Module (CMM) - update to 2pet16c-2.5.12c
glibc - update to 2.26-26.fc27

• https://sourceware.org/bugzilla/show_bug.cgi?id=22774

• Gentoo update for glibc
• SUSE Linux update for glibc
• OpenSUSE Linux update for glibc
• SUSE Linux update for glibc
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Multiple vulnerabilities in IBM Integrated Management Module II (IMM2)
• Fedora 27 update for glibc