Buffer overflow in Block IO Tracing - CVE-2018-10689

Vulnerability identifier: #VU22938

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10689

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the dev_map_read() function in btt/devmap.c in blktrace. A local user can create a specially crafted file, pass it to he application that is using the vulnerable component (e.g. btt program), trigger memory corruption and execute arbitrary code with elevated privileges.

Block IO Tracing
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Opensuse
Fedora
blktrace
Session Smart Router

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

blktrace - addressed in versions 1.2.0-6.fc26, 1.2.0-6.fc27, 1.2.0-6.fc28
Session Smart Router - addressed in versions 5.4.7, 5.5.3

• http://git.kernel.dk/?p=blktrace.git;a=log;h=d61ff409cb4dda31386373d706ea0cfb1aaac5b7
• https://access.redhat.com/errata/RHSA-2019:2162
• https://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git/commit/?id=d61ff409cb4dda31386373d706ea0cfb1aaac5b7
• https://www.spinics.net/lists/linux-btrace/msg00847.html

• Buffer overflow in blktrace
• Amazon Linux AMI update for blktrace
• Red Hat update for blktrace
• OpenSUSE Linux update for blktrace
• Gentoo update for blktrace
• Multiple vulnerabilities in Juniper Networks Session Smart Router
• Fedora 27 update for blktrace
• Fedora 26 update for blktrace
• Fedora 28 update for blktrace