Integer overflow in Linux kernel - CVE-2018-13406
Published: July 9, 2018 / Updated: July 10, 2018
Vulnerability identifier: #VU13630
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-13406
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to integer overflow in the uvesafb_setcmap function, as defined in the drivers/video/fbdev/uvesafb.c source code file. A local attacker can execute a file or program that submits malicious input, trigger memory corruption and cause the affected software to crash.
Affected software
Linux kernel
Fedora
Opensuse
kernel
Fedora
Opensuse
kernel
How to mitigate CVE-2018-13406
Update to version 4.17.4.
Linux kernel - update to 4.17.4
kernel - addressed in versions 4.17.5-100.fc27, 4.17.5-200.fc28
kernel - addressed in versions 4.17.5-100.fc27, 4.17.5-200.fc28