Linux · Linux Kernel · CVE-2018-12896
**Name of the Vulnerable Software and Affected Versions**
Linux kernel versions prior to 4.17.3
**Description**
The issue is related to an Integer Overflow in the POSIX timer code, specifically in kernel/time/posix-timers.c. This overflow occurs due to the way overrun accounting works, where the overrun can exceed INT MAX, but the accounting is based on integers. As a result, the accounting values visible to user space via timer getoverrun(2) and siginfo::si overrun can appear random. A local user can potentially cause a denial of service (signed integer overflow) by crafting specific system calls, including mmap, futex, timer create, and timer settime.
**Recommendations**
For Linux kernel versions prior to 4.17.3, update to a version 4.17.3 or later to resolve the issue.