PT-2018-3360 · Linux+5 · Linux Kernel+5

Jann Horn · Published 2018-11-30 · Updated 2020-08-24 · CVE-2018-18397

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.19.7

Description: The issue exists due to insufficient input validation in the userfaultfd component of the Linux kernel. This could allow an attacker to impact the integrity of protected information. The userfaultfd implementation mishandles access control for certain UFFDIO ioctl calls, allowing local users to write data into holes in a tmpfs file under specific conditions.

Recommendations: For Linux kernel versions prior to 4.19.7, update to version 4.19.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the userfaultfd component until a patch is available.

Exploit

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-20

CWE-863

Related Identifiers

ALT-PU-2018-2801

ALT-PU-2018-2813

ALT-PU-2019-1433

BDU:2020-00620

CESA-2019_0163

CVE-2018-18397

MGASA-2018-0487

MGASA-2019-0098

MGASA-2019-0171

OPENSUSE-SU-2019:0065-1

OPENSUSE-SU-2019_0065-1

RHSA-2019:0163

RHSA-2019:0202

RHSA-2019:0324

RHSA-2019:0831

RHSA-2019_0163

SUSE-SU-2019:0150-1

SUSE-SU-2019:0196-1

SUSE-SU-2019:0222-1

SUSE-SU-2019:0224-1

USN-3901-1

USN-3901-2

USN-3903-1

USN-3903-2

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 415

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/rds_atomic_free_op_null_pointer_deref_priv_esc.rb · Exploit
• 🔥 https://github.com/butterflyhack/CVE-2019-10207 · Exploit
• 🔥 https://github.com/mmxsrup/CVE-2019-5489 · Exploit
• 🔥 https://bugs.chromium.org/p/project-zero/issues/detail?id=1700 · Exploit
• https://github.com/torvalds/linux/commit/29ec90660d68bbdd69507c1c8b4e33aa299278b1 · Patch
• https://access.redhat.com/errata/RHSA-2019:0202 · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.87 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0831 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-6133 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0171 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-4528.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0196-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-4541.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3903-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3901-2 · Vendor Advisory