Use-after-free in Linux kernel - CVE-2018-17182

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU14817

Use-after-free in Linux kernel - CVE-2018-17182

Published: September 20, 2018


Vulnerability identifier: #VU14817
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-17182
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in vmacache_flush_all() function in mm/vmacache.c file. A local user can trigger the use-after-free error via certain thread creation, map, unmap, invalidation, and dereference operations and execute arbitrary code on the system with elevated privileges.


Affected software

Linux kernel
Amazon Linux AMI
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
Slackware Linux
Fedora
Opensuse

kernel-alt (Red Hat package)
kernel
kernel-headers

How to mitigate CVE-2018-17182

Install updates from vendor's website.

Linux kernel - update to 4.18.9
kernel-alt (Red Hat package) - update to 4.14.0-115.2.2.el7a
kernel - addressed in versions 4.18.9-100.fc27, 4.18.9-200.fc28, 4.18.9-300.fc29
kernel-headers - addressed in versions 4.18.9-100.fc27, 4.18.9-200.fc28, 4.18.9-300.fc29

External References

Related Security Bulletins