NULL pointer dereference in Linux kernel - CVE-2018-7191

Vulnerability identifier: #VU18539

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7191

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows local users to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when processing requests to ioctl(TUNSETIFF). A local user can cause a denial of service  via a malicious ioctl(TUNSETIFF) call with a dev name containing a / character.

Linux kernel
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Virtualization Host - Extended Update Support 4.2 for RHEL
kernel (Red Hat package)

Install update from vendor's website.

Linux kernel - update to 4.13.14
kernel (Red Hat package) - update to 3.10.0-957.56.1.el7

• https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1743792
• https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1748846
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.14
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0ad646c81b2182f7fa67ec0c8c825e0ee165696d
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5c25f65fd1e42685f7ccd80e0621829c105785d9
• https://github.com/torvalds/linux/commit/0ad646c81b2182f7fa67ec0c8c825e0ee165696d
• https://github.com/torvalds/linux/commit/5c25f65fd1e42685f7ccd80e0621829c105785d9

• NULL pointer dereference in Linux kernel
• Red Hat Enterprise Linux 7.6 Extended Update Support update for kernel