#VU12742 Null pointer dereference in Linux kernel


Published: 2018-05-16 | Updated: 2018-05-16

Vulnerability identifier: #VU12742

Vulnerability risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-1000200

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to a flaw in the Linux kernel where an out of memory (oom) killing of a process that has large spans of mlocked memory. A local attacker can trigger NULL pointer dereference and cause the system to crash.

Mitigation
Update to version 4.16.9.

Vulnerable software versions

Linux kernel: 4.10 - 4.16.8

CPE

External links
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.9

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?


Latest bulletins with this vulnerability


Denial of service in Linux Kernel