PT-2018-10291 · Linux+3 · Linux Kernel+3

Jann Horn · Published 2018-04-06 · Updated 2022-11-29 · CVE-2018-1108

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.17-rc1

Description The issue is related to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.

Recommendations For Linux kernel versions prior to 4.17-rc1, update to version 4.17-rc1 or later to resolve the issue.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

ALT-PU-2018-1557

ALT-PU-2018-1621

ALT-PU-2018-1622

ALT-PU-2018-1659

ALT-PU-2018-1660

ALT-PU-2019-1433

CVE-2018-1108

DLA-3065-1

DSA-4188-1

DSA-4196-1

MGASA-2018-0249

MGASA-2018-0265

OPENSUSE-SU-2018_2119-1

USN-3752-1

USN-3752-2

USN-3752-3

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 78

• https://ubuntu.com/security/notices/USN-3752-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-11412 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1108 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3752-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1108 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10881 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1108 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-13406 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0265.html · Security Note
• https://ubuntu.com/security/notices/USN-3752-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0249.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-1108 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000204 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-9415 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0249 · Vendor Advisory