Improper input validation in Linux kernel - CVE-2018-18690
Published: October 29, 2018 / Updated: October 30, 2018
Vulnerability identifier: #VU15584
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-18690
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to improper handling of ATTR_REPLACE operations by the xfs_attr_shortform_addname function, as defined in the fs/xfs/libxfs/xfs_attr.c source code file. A local attacker can access the system and execute an application that submits malicious input, trigger corruption of the Extended File System (XFS) and cause the service to crash.
Affected software
Linux kernel
Opensuse
Opensuse
How to mitigate CVE-2018-18690
Install update from vendor's website.