PT-2018-14563 · Linux+1 · Linux Kernel+1

Daniel Dadap · Publicado 2018-10-25 · Atualizado 2019-10-03 · CVE-2018-18653

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions used in Ubuntu 18.10

Description The issue allows privileged local users to bypass intended Secure Boot restrictions and execute untrusted code by loading arbitrary kernel modules. This occurs due to a modified kernel/module.c, in conjunction with certain configuration options, leading to mishandling of the result of signature verification.

Recommendations For Ubuntu 18.10, consider disabling UEFI Secure Boot or restricting the loading of kernel modules until a patch is available.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2018-18653

USN-3832-1

USN-3835-1

Produtos afetados

Linux Kernel

Ubuntu

Referências · 13

• 🔥 https://launchpad.net/bugs/1798863 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18653 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3832-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18653 · Nota de Segurança
• https://usn.ubuntu.com/3832-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3835-1 · Aviso do Fabricante
• https://lists.ubuntu.com/archives/kernel-team/2018-October/096299.html · Nota
• https://ubuntu.com/security/CVE-2018-18653 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-18653 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-18653 · Aviso do Fabricante
• https://usn.ubuntu.com/3835-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-18653 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18653 · Aviso do Fabricante