Resource exhaustion in Linux kernel - CVE-2018-20784

Vulnerability identifier: #VU17858

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-20784

CWE-ID: CWE-400

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in resource management within the update_blocked_averages function in kernel/sched/fair.c when processing leaf cfs_rq's. A local user can cause resource exhaustion and perform a denial of service (DoS) attack.

Linux kernel
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise High Availability
SecurID Authentication Manager
kgraft-patch-4_4_180-94_164-default
kgraft-patch-4_4_180-94_164-default-debuginfo
kernel-default-base
kernel-default
kernel-source
kernel-macros
kernel-devel
kernel-syms
kernel-default-devel
kernel-default-debugsource
kernel-default-debuginfo
kernel-default-base-debuginfo
dlm-kmp-default
ocfs2-kmp-default-debuginfo
ocfs2-kmp-default
gfs2-kmp-default-debuginfo
gfs2-kmp-default
dlm-kmp-default-debuginfo
cluster-md-kmp-default-debuginfo
cluster-md-kmp-default
kernel-default-man
kernel-default-kgraft

Install updates from vendor's website.

Linux kernel - update to 4.20.2
SecurID Authentication Manager - update to 8.6 Patch 4
kgraft-patch-4_4_180-94_164-default - update to 1-4.3.2
kgraft-patch-4_4_180-94_164-default-debuginfo - update to 1-4.3.2
kernel-default-base - addressed in versions 4.4.121-92.175.2, 4.4.121-92.205.1, 4.4.121-92.208.1, 4.4.180-94.164.3
kernel-default - addressed in versions 4.4.121-92.175.2, 4.4.121-92.205.1, 4.4.121-92.208.1, 4.4.180-94.164.3
kernel-source - addressed in versions 4.4.121-92.175.2, 4.4.121-92.205.1, 4.4.121-92.208.1, 4.4.180-94.164.2
kernel-macros - addressed in versions 4.4.121-92.175.2, 4.4.121-92.205.1, 4.4.121-92.208.1, 4.4.180-94.164.2
kernel-devel - addressed in versions 4.4.121-92.175.2, 4.4.121-92.205.1, 4.4.121-92.208.1, 4.4.180-94.164.2
kernel-syms - addressed in versions 4.4.121-92.175.2, 4.4.121-92.205.1, 4.4.121-92.208.1, 4.4.180-94.164.2
kernel-default-devel - addressed in versions 4.4.121-92.175.2, 4.4.121-92.205.1, 4.4.121-92.208.1, 4.4.180-94.164.3
kernel-default-debugsource - addressed in versions 4.4.121-92.175.2, 4.4.121-92.205.1, 4.4.121-92.208.1, 4.4.180-94.164.3
kernel-default-debuginfo - addressed in versions 4.4.121-92.175.2, 4.4.121-92.205.1, 4.4.121-92.208.1, 4.4.180-94.164.3
kernel-default-base-debuginfo - addressed in versions 4.4.121-92.175.2, 4.4.121-92.205.1, 4.4.121-92.208.1, 4.4.180-94.164.3
dlm-kmp-default - update to 4.4.180-94.164.3
ocfs2-kmp-default-debuginfo - update to 4.4.180-94.164.3
ocfs2-kmp-default - update to 4.4.180-94.164.3
gfs2-kmp-default-debuginfo - update to 4.4.180-94.164.3
gfs2-kmp-default - update to 4.4.180-94.164.3
dlm-kmp-default-debuginfo - update to 4.4.180-94.164.3
cluster-md-kmp-default-debuginfo - update to 4.4.180-94.164.3
cluster-md-kmp-default - update to 4.4.180-94.164.3
kernel-default-man - update to 4.4.180-94.164.3
kernel-default-kgraft - update to 4.4.180-94.164.3

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c40f7d74c741a907cfaeb73a7697081881c497d0
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.2
• https://github.com/torvalds/linux/commit/c40f7d74c741a907cfaeb73a7697081881c497d0

• Denial of service in Linux kernel
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel
• SecurID Authentication Manager update for third-party components