PT-2018-12615 · Linux+2 · Linux Kernel+2

Wen Xu · Published 2018-07-27 · Updated 2019-09-02 · CVE-2018-14609

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.17.11

Description An issue exists in the Linux kernel where there is an invalid pointer dereference in the del reloc root() function in fs/btrfs/relocation.c. This occurs when mounting a crafted btrfs image and is related to removing reloc rb trees when reloc control has not been initialized.

Recommendations For Linux kernel versions prior to 4.17.11, update to version 4.17.11 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted btrfs images until the issue is resolved. Restrict access to the fs/btrfs/relocation.c module to minimize the risk of exploitation.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2018-2092

ALT-PU-2018-2094

ALT-PU-2019-1433

CVE-2018-14609

DLA-1529-1

DLA-1531-1

DSA-4308-1

USN-3821-1

USN-3821-2

USN-4094-1

USN-4118-1

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 91

• 🔥 https://bugzilla.kernel.org/show_bug.cgi?id=199833 · Exploit
• https://osv.dev/vulnerability/USN-4094-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14609 · Security Note
• https://usn.ubuntu.com/4094-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-13093 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14614 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13631 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20511 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15220 · Vendor Advisory
• https://usn.ubuntu.com/3821-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15214 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4308-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9506 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4094-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10880 · Vendor Advisory