PT-2018-2382 · Linux+5 · Linux Kernel+5

Jann Horn · Published 2018-10-02 · Updated 2020-10-15 · CVE-2018-17972

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.18.11

Description An issue in the proc pid stack function allows a local attacker to exploit racy stack unwinding and leak kernel task stack contents due to inadequate access control. This enables an attacker to gain unauthorized access to protected information.

Recommendations For Linux kernel versions through 4.18.11, update to a version that includes a fix for the proc pid stack function issue to prevent unauthorized access to kernel task stack contents.

Fix

Race Condition

Improper Access Control

Weakness Enumeration

CWE-362

CWE-284

Related Identifiers

ALT-PU-2018-2420

ALT-PU-2018-2445

ALT-PU-2019-1433

BDU:2019-00570

CESA-2019_0512

CESA-2019_2473

CVE-2018-17972

DLA-1715-1

DLA-1731-1

DLA-1731-2

OPENSUSE-SU-2019_1407-1

RHSA-2019:0512

RHSA-2019:0514

RHSA-2019:0831

RHSA-2019:2473

RHSA-2019_0512

RHSA-2019_0514

RHSA-2019_2473

SUSE-SU-2019:14089-1

SUSE-SU-2019:1527-1

SUSE-SU-2019:1532-1

SUSE-SU-2019:1533-1

SUSE-SU-2019:1534-1

SUSE-SU-2019:1692-1

SUSE-SU-2019_14089-1

USN-3821-1

USN-3821-2

USN-3832-1

USN-3835-1

USN-3871-1

USN-3871-2

USN-3871-3

USN-3871-4

USN-3871-5

USN-3880-1

USN-3880-2

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 229

• https://usn.ubuntu.com/3821-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10882 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2473 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3880-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3871-2 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0512 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0514 · Vendor Advisory
• https://marc.info/?l=linux-fsdevel&m=153806242024956&w=2 · Patch
• https://ubuntu.com/security/CVE-2018-14617 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3871-4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1066 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3871-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10877 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1692-1 · Vendor Advisory
• https://usn.ubuntu.com/3871-4 · Vendor Advisory