PT-2018-12615 · Linux+2 · Linux Kernel+2

Wen Xu · Publicado 2018-07-27 · Atualizado 2019-09-02 · CVE-2018-14609

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.17.11

Description An issue exists in the Linux kernel where there is an invalid pointer dereference in the del reloc root() function in fs/btrfs/relocation.c. This occurs when mounting a crafted btrfs image and is related to removing reloc rb trees when reloc control has not been initialized.

Recommendations For Linux kernel versions prior to 4.17.11, update to version 4.17.11 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted btrfs images until the issue is resolved. Restrict access to the fs/btrfs/relocation.c module to minimize the risk of exploitation.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2018-2092

ALT-PU-2018-2094

ALT-PU-2019-1433

CVE-2018-14609

DLA-1529-1

DLA-1531-1

DSA-4308-1

USN-3821-1

USN-3821-2

USN-4094-1

USN-4118-1

Produtos afetados

Alt Linux

Linux Kernel

Ubuntu

Referências · 91

• 🔥 https://bugzilla.kernel.org/show_bug.cgi?id=199833 · Exploit
• https://osv.dev/vulnerability/USN-4094-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14609 · Nota de Segurança
• https://usn.ubuntu.com/4094-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-13093 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-14614 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-13631 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-20511 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html · Nota
• https://ubuntu.com/security/CVE-2019-15220 · Aviso do Fabricante
• https://usn.ubuntu.com/3821-2 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-15214 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4308-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-9506 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-4094-1 · Aviso do Fabricante