PT-2018-9618 · Linux+2 · Linux Kernel+2

Marcus Meissner · Publicado 2018-04-06 · Atualizado 2024-08-05 · CVE-2018-10021

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.16

Description: The issue allows local users to cause a denial of service (ata qc leak) by triggering certain failure conditions, specifically when physically proximate attackers unplug SAS Host Bus Adapter cables. A third party disputes the relevance of this report.

Recommendations: Update to Linux kernel version 4.16 or later to resolve the issue. As a temporary workaround, consider restricting physical access to SAS Host Bus Adapter cables to minimize the risk of exploitation.

Correção

Identificadores relacionados

ALT-PU-2018-1557

ALT-PU-2019-1433

CVE-2018-10021

DLA-1423-1

DLA-1529-1

USN-3678-1

USN-3678-2

USN-3678-3

USN-3678-4

USN-3696-1

USN-3696-2

USN-3754-1

Produtos afetados

Alt Linux

Linux Kernel

Ubuntu

Referências · 93

• https://github.com/torvalds/linux/commit/318aaf34f1179b39fa9c30fa0f3288b645beee39 · Nota
• https://ubuntu.com/security/CVE-2018-1093 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-1092 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-13094 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-2671 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-10021 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-16538 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-3665 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3696-2 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-16536 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-10021 · Nota de Segurança
• https://osv.dev/vulnerability/USN-3754-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-10877 · Aviso do Fabricante
• https://usn.ubuntu.com/3678-2 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-16537 · Aviso do Fabricante