PT-2018-10176 · Linux+4 · Linux Kernel+4

Adam Mariš · Published 2017-10-05 · Updated 2019-05-17 · CVE-2018-1091

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.13.5

Description The issue is related to a missing processor feature check and an erroneous use of transactional memory instructions in the core dump path. This can lead to a denial of service when a guest kernel crash is triggered from unprivileged userspace during a core dump on a POWER host.

Recommendations For Linux kernel versions prior to 4.13.5, update to version 4.13.5 or later to resolve the issue.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-391

Related Identifiers

ALT-PU-2017-2378

ALT-PU-2018-1991

CESA-2018_1318

CVE-2018-1091

OPENSUSE-SU-2018_0972-1

RHSA-2018:1318

RHSA-2018_1318

SUSE-SU-2018:1048-1

SUSE-SU-2018:1217-1

SUSE-SU-2019:1287-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

References · 175

• https://github.com/torvalds/linux/commit/c1fa0768a8713b135848f78fd43ffc208d8ded70 · Patch
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c1fa0768a8713b135848f78fd43ffc208d8ded70 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1091 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1091 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1091 · Vendor Advisory
• https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.5 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1048-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1318 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1091 · Security Note
• https://linux.oracle.com/errata/ELSA-2018-1318.html · Vendor Advisory
• https://marc.info/?l=linuxppc-embedded&m=150535531910494&w=2 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2018:1217-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1287-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1091 · Security Note