PT-2018-17205 · Linux · Linux Kernel

Andrey Konovalov · Published 2018-07-06 · Updated 2023-07-19 · CVE-2018-5873

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.11

Description: A race condition in the ns get path function in fs/nsfs.c can lead to a Use After Free condition when accessing files. This issue also affects Android releases from CAF using the Linux kernel before security patch level 2018-07-05.

Recommendations: For Linux kernel versions prior to 4.11, update to version 4.11 or later to resolve the issue. For Android releases from CAF using the Linux kernel, apply the security patch level 2018-07-05 or later.

Fix

Race Condition

Use After Free

Weakness Enumeration

CWE-362

CWE-416

Related Identifiers

CVE-2018-5873

Affected Products

Linux Kernel

References · 13

• https://github.com/torvalds/linux/commit/073c516ff73557a8f7315066856c04b50383ac34 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-5873 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5873 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-5873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5873 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-5873 · Security Note
• https://osv.dev/vulnerability/CVE-2018-5873 · Vendor Advisory
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=073c516ff73557a8f7315066856c04b50383ac34 · Patch
• https://source.android.com/security/bulletin/2018-07-01 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5873 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2018-4227.html · Vendor Advisory
• https://codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletin · Note
• https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=34742aaf7cb16c95edba4a7afed6d2c4fa7e434b · Note