PT-2018-2897 · Linux+3 · Linux Kernel+3

Tyler Hicks · Published 2018-07-03 · Updated 2019-10-09 · CVE-2018-6555

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.17

Description The issue is related to the irda setsockopt function in the Linux kernel, which can cause a denial of service due to a use-after-free error, potentially leading to a system crash. This may also have other unspecified impacts. The vulnerability can be exploited via an AF IRDA socket.

Recommendations For Linux kernel versions prior to 4.17, update to version 4.17 or later to resolve the issue. As a temporary workaround, consider restricting access to AF IRDA sockets to minimize the risk of exploitation.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2018-1971

ALT-PU-2018-1976

ALT-PU-2018-2337

ALT-PU-2018-2338

ALT-PU-2019-1433

BDU:2019-02508

CVE-2018-6555

DLA-1529-1

DLA-1531-1

DSA-4308-1

MGASA-2018-0373

MGASA-2018-0374

MGASA-2018-0419

OPENSUSE-SU-2018_2738-1

OPENSUSE-SU-2018_3071-1

SUSE-SU-2018:2775-1

SUSE-SU-2018:2776-1

SUSE-SU-2018:2858-1

SUSE-SU-2018:2862-1

SUSE-SU-2018:2879-1

SUSE-SU-2018:2907-1

SUSE-SU-2018:2908-1

SUSE-SU-2018:2908-2

SUSE-SU-2018:2980-1

SUSE-SU-2018:2981-1

SUSE-SU-2018:3083-1

SUSE-SU-2018:3084-1

SUSE-SU-2018:3088-1

SUSE-SU-2018:3961-1

USN-3775-1

USN-3775-2

USN-3776-1

USN-3776-2

USN-3777-1

USN-3777-2

USN-3777-3

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 595

• https://ubuntu.com/security/CVE-2018-15572 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-6554 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5715 · Vendor Advisory
• https://spinics.net/lists/stable/msg255035.html · Patch
• https://ubuntu.com/security/CVE-2018-3639 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2862-1 · Vendor Advisory
• https://spinics.net/lists/stable/msg255031.html · Patch
• https://osv.dev/vulnerability/SUSE-SU-2018:3083-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10902 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2858-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2879-1 · Vendor Advisory
• https://usn.ubuntu.com/3776-2 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4308-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3775-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2981-1 · Vendor Advisory