PT-2018-3630 · Linux+3 · Linux Kernel+3

Icytxw · Published 2018-07-01 · Updated 2019-04-27 · CVE-2018-12896

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.17.3

Description The issue is related to an Integer Overflow in the POSIX timer code, specifically in kernel/time/posix-timers.c. This overflow occurs due to the way overrun accounting works, where the overrun can exceed INT MAX, but the accounting is based on integers. As a result, the accounting values visible to user space via timer getoverrun(2) and siginfo::si overrun can appear random. A local user can potentially cause a denial of service (signed integer overflow) by crafting specific system calls, including mmap, futex, timer create, and timer settime.

Recommendations For Linux kernel versions prior to 4.17.3, update to a version 4.17.3 or later to resolve the issue.

Exploit

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2018-1971

ALT-PU-2018-1976

ALT-PU-2019-1433

BDU:2021-01436

CVE-2018-12896

DLA-1715-1

DLA-1731-1

DLA-1731-2

OPENSUSE-SU-2018_2738-1

OPENSUSE-SU-2018_3071-1

SUSE-SU-2018:2775-1

SUSE-SU-2018:2776-1

SUSE-SU-2018:2858-1

SUSE-SU-2018:2862-1

SUSE-SU-2018:2879-1

SUSE-SU-2018:2908-1

SUSE-SU-2018:2908-2

SUSE-SU-2018:2980-1

SUSE-SU-2018:2981-1

SUSE-SU-2018:3083-1

SUSE-SU-2018:3084-1

SUSE-SU-2018:3088-1

SUSE-SU-2018:3618-1

SUSE-SU-2018:3961-1

SUSE-SU-2018_3618-1

USN-3847-1

USN-3847-2

USN-3847-3

USN-3848-1

USN-3848-2

USN-3849-1

USN-3849-2

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 587

• 🔥 https://github.com/lcytxw/bug_repro/tree/master/bug_200189 · Exploit
• https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76 · Patch
• https://usn.ubuntu.com/3848-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18174 · Vendor Advisory
• https://bugzilla.kernel.org/show_bug.cgi?id=200189 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3849-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3847-3 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2858-1 · Vendor Advisory
• https://usn.ubuntu.com/3848-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18710 · Vendor Advisory
• https://usn.ubuntu.com/3849-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3849-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3088-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12896 · Vendor Advisory
• https://usn.ubuntu.com/3847-1 · Vendor Advisory