Improper input validation in Linux kernel - CVE-2018-18021

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU15177

Improper input validation in Linux kernel - CVE-2018-18021

Published: October 8, 2018 / Updated: October 9, 2018


Vulnerability identifier: #VU15177
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-18021
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the arch/arm64/kvm/guest.c source code file due to the mishandling of the sanity check for the KVM_SET_ON_REG IOCTL function. A local attacker can create a malicious Kernel-based Virtual Machine (KVM), cause an illegal exception return and cause the system to crash.


Affected software

Linux kernel
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
Fedora

kernel-alt (Red Hat package)
kernel
kernel-headers

How to mitigate CVE-2018-18021

Install update from vendor's website.

kernel-alt (Red Hat package) - update to 4.14.0-115.2.2.el7a
kernel - addressed in versions 4.18.12-100.fc27, 4.18.12-200.fc28, 4.18.12-300.fc29
kernel-headers - addressed in versions 4.18.12-100.fc27, 4.18.12-200.fc28, 4.18.12-300.fc29

External References

Related Security Bulletins