PT-2018-3862 · Linux+3 · Linux Kernel+3

Silvio Cesare

·

Publicado

2018-06-12

·

Atualizado

2023-02-24

·

CVE-2018-13406

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.17.4
Description The issue is related to an integer overflow in the uvesafb setcmap function, which could allow local attackers to crash the kernel or potentially elevate privileges. This is because kmalloc array is not used. The vulnerability may be exploited to cause a denial of service or to gain elevated privileges.
Recommendations For Linux kernel versions prior to 4.17.4, update to version 4.17.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the uvesafb setcmap function to minimize the risk of exploitation.

Correção

Integer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALT-PU-2018-1971
ALT-PU-2018-1975
ALT-PU-2018-1976
BDU:2023-01296
CVE-2018-13406
DLA-1529-1
DLA-1715-1
OPENSUSE-SU-2018_2118-1
OPENSUSE-SU-2018_2119-1
SUSE-SU-2018:2051-1
SUSE-SU-2018:2092-1
SUSE-SU-2018:2150-1
SUSE-SU-2018:2222-1
SUSE-SU-2018:2332-1
SUSE-SU-2018:2344-1
SUSE-SU-2018:2344-2
SUSE-SU-2018:2362-1
SUSE-SU-2018:2366-1
SUSE-SU-2018:2384-1
SUSE-SU-2018:2637-1
USN-3752-1
USN-3752-2
USN-3752-3
USN-3753-1
USN-3753-2
USN-3754-1

Produtos afetados

Alt Linux
Linux Kernel
Suse
Ubuntu