PT-2017-3574 · Linux+3 · Linux Kernel+3

Hou Tao · Published 2017-02-03 · Updated 2023-02-24 · CVE-2018-7480

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.11

Description: The issue is related to the blkcg init queue function in the Linux kernel, specifically in the block/blk-cgroup.c file. It is caused by a double free error, which can be exploited by local users. This exploitation may lead to a denial of service or potentially other unspecified impacts.

Recommendations: For Linux kernel versions prior to 4.11, update to version 4.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the blkcg init queue function to minimize the risk of exploitation.

Fix

DoS

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALT-PU-2017-1854

ALT-PU-2018-1464

BDU:2018-00491

CVE-2018-7480

DSA-4188-1

OPENSUSE-SU-2018_3202-1

SUSE-SU-2018:3003-1

SUSE-SU-2018:3004-1

SUSE-SU-2018:3084-1

SUSE-SU-2018:3659-1

SUSE-SU-2019:0095-1

USN-3654-1

USN-3654-2

USN-3656-1

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 276

• https://github.com/torvalds/linux/commit/9b54d816e00425c3a517514e0d677bb3cec49258 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18222 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3654-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7480 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7757 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7480 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7480 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7480 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0095-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18193 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1068 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3654-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-8822 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7995 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-17975 · Vendor Advisory