PT-2018-2804 · Linux+1 · Linux Kernel+1

Vladis Dronov · Publicado 2018-08-21 · Atualizado 2023-02-13 · CVE-2018-14656

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is caused by a missing address check in the callers of the show opcodes() function in the Linux kernel, allowing an attacker to dump kernel memory at an arbitrary kernel address into the dmesg log. This is also described as a vulnerability in the show opcodes() function due to input validation errors, which can be exploited to access protected kernel information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2018-2192

ALT-PU-2018-2210

ALT-PU-2019-1433

BDU:2019-02163

CVE-2018-14656

Produtos afetados

Alt Linux

Linux Kernel

Referências · 18

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1650 · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14656 · Aviso do Fabricante
• http://securitytracker.com/id/1041804 · Nota
• https://lore.kernel.org/lkml/[e-mail]/T · Nota
• https://osv.dev/vulnerability/CVE-2018-14656 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02163 · Nota de Segurança
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=342db04ae71273322f0011384a9ed414df8bdae4 · Correção
• https://ubuntu.com/security/CVE-2018-14656 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-14656 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14656 · Aviso do Fabricante
• https://seclists.org/oss-sec/2018/q4/9 · Correção
• https://access.redhat.com/security/cve/cve-2018-14656 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14656 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14656 · Correção
• https://openwall.com/lists/oss-security/2018/10/04/1 · Nota