PT-2018-11598 · Linux+3 · Linux Kernel+3

Wen Xu · Published 2017-12-08 · Updated 2022-10-07 · CVE-2018-13096

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.14.15 is not specified, however, the issue is in versions through 4.14.

Description An issue in the Linux kernel can cause a denial of service due to out-of-bounds memory access and BUG when mounting a crafted f2fs image with an abnormal bitmap size.

Recommendations For Linux kernel versions through 4.14, consider updating to a version that includes the necessary fixes to prevent out-of-bounds memory access when mounting f2fs images.

Fix

DoS

Memory Corruption

Out of bounds Read

Weakness Enumeration

CWE-787

CWE-125

Related Identifiers

ALT-PU-2017-2771

ALT-PU-2018-1991

CVE-2018-13096

DLA-1715-1

OPENSUSE-SU-2018_3202-1

USN-3821-1

USN-3821-2

USN-4094-1

USN-4118-1

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 95

• https://osv.dev/vulnerability/USN-4094-1 · Vendor Advisory
• https://usn.ubuntu.com/4094-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-13093 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14614 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13631 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20511 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15220 · Vendor Advisory
• https://usn.ubuntu.com/3821-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15214 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9506 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4094-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10880 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=e34438c903b653daca2b2a7de95aed46226f8ed3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20784 · Vendor Advisory