PT-2017-3940 · Linux+4 · Linux Kernel+4
Dmitry Alexeev
·
Publicado
2017-10-16
·
Atualizado
2020-04-08
·
CVE-2018-7191
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 4.13.14
Description
The issue is related to a null pointer dereference in the dev get valid name function of the TUN subsystem in the Linux kernel. This can be exploited by local users to cause a denial of service, resulting in a system panic, by making an ioctl(TUNSETIFF) call with a dev name containing a / character.
Recommendations
For Linux kernel versions prior to 4.13.14, update to version 4.13.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the TUN subsystem to minimize the risk of exploitation. Avoid using the ioctl(TUNSETIFF) call with a dev name containing a / character until the issue is resolved.
Exploit
Correção
DoS
NULL Pointer Dereference
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Linux Kernel
Red Hat
Suse