Memory corruption in Linux kernel - CVE-2018-20169

Vulnerability identifier: #VU16628

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-20169

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists in the USB subsystem due to improper checks on the minimum and maximum size of data allowed when reading an extra descriptor by the USB subsystem of the affected software, related to the __usb_get_extra_descriptor in the drivers/usb/core/usb.c source code file. A local attacker can insert a USB device designed to submit malicious input, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Linux kernel
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Virtualization Host - Extended Update Support 4.2 for RHEL
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Fedora
Opensuse
MRG Realtime
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel
kernel-headers
kernel-tools
IBM MQ Appliance
4769 Developer's Toolkit

The vulnerability has been fixed in the versions 4.14.88, 4.19.9, 4.4.167, 4.9.145.

Linux kernel - addressed in versions 4.4.167, 4.9.145, 4.14.88, 4.19.9
kernel (Red Hat package) - addressed in versions 3.10.0-693.69.1.el7, 3.10.0-957.56.1.el7
IBM MQ Appliance - update to 9.2.0.6
kernel-rt (Red Hat package) - addressed in versions 3.10.0-693.69.1.rt56.667.el6rt, 4.18.0-147.rt24.93.el8
kernel - update to 4.19.10-200.fc28
kernel-headers - update to 4.19.10-200.fc28
kernel-tools - update to 4.19.10-200.fc28
4769 Developer's Toolkit - update to 7.3.44

• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.9

• Multiple vulnerabilities in Linux Kernel
• Red Hat Enterprise Linux 7 update for kernel
• OpenSUSE Linux update for the Linux Kernel
• Multiple vulnerabilities in IBM MQ Appliance
• Red Hat Enterprise Linux 8 update for kernel-rt
• Red Hat Enterprise MRG 2 update for kernel-rt
• Red Hat Enterprise Linux 7.6 Extended Update Support update for kernel
• Multiple vulnerabiities in IBM 4769 Developer's Toolkit
• Fedora 28 update for kernel, kernel-headers, kernel-tools