PT-2018-3523 · Linux+3 · Linux Kernel+3

Wen Xu · Published 2016-01-13 · Updated 2022-10-07 · CVE-2018-13099

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.4

Description: The issue is related to a buffer overflow in the fs/f2fs/inline.c component of the Linux kernel, which can lead to out-of-bounds memory access. This can cause a denial of service. The problem occurs when an inline inode contains an invalid reserved blkaddr in a modified f2fs filesystem image.

Recommendations: For Linux kernel versions prior to 4.4, update to a version 4.4 or later to resolve the issue.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2016-1018

ALT-PU-2016-1485

BDU:2020-03264

CVE-2018-13099

DLA-1531-1

DSA-4308-1

OPENSUSE-SU-2018_3202-1

USN-3932-1

USN-3932-2

USN-4094-1

USN-4118-1

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 122

• 🔥 https://bugzilla.kernel.org/show_bug.cgi?id=200179 · Exploit
• https://usn.ubuntu.com/4094-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13631 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-7222 · Vendor Advisory
• https://seclists.org/bugtraq/2019/Jan/52 · Patch
• https://ubuntu.com/security/CVE-2019-15214 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4308-1 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=3bfe2049c222b23342ff2a216cd5a869e8a14897 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9506 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20784 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12819 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3932-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15292 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-13098 · Vendor Advisory