PT-2018-14563 · Linux+1 · Linux Kernel+1

Daniel Dadap · Published 2018-10-25 · Updated 2019-10-03 · CVE-2018-18653

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions used in Ubuntu 18.10

Description The issue allows privileged local users to bypass intended Secure Boot restrictions and execute untrusted code by loading arbitrary kernel modules. This occurs due to a modified kernel/module.c, in conjunction with certain configuration options, leading to mishandling of the result of signature verification.

Recommendations For Ubuntu 18.10, consider disabling UEFI Secure Boot or restricting the loading of kernel modules until a patch is available.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2018-18653

USN-3832-1

USN-3835-1

Affected Products

Linux Kernel

Ubuntu

References · 13

• 🔥 https://launchpad.net/bugs/1798863 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18653 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3832-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18653 · Security Note
• https://usn.ubuntu.com/3832-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3835-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18653 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18653 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-18653 · Vendor Advisory
• https://usn.ubuntu.com/3835-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-18653 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18653 · Vendor Advisory
• https://lists.ubuntu.com/archives/kernel-team/2018-October/096299.html · Note