PT-2019-10229 · Linux · Linux Kernel

Leoaccount · Published 2019-02-25 · Updated 2019-02-26 · CVE-2018-20788

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to integer overflows in the led driver for custom Linux kernels, specifically in the drivers/leds/leds-aw2023.c file. This occurs due to a left-shifting operation when the right-hand operand can be equal to or greater than the integer length. A crafted application can exploit this for denial of service.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2018-20788

Affected Products

Linux Kernel

References · 3

• https://osv.dev/vulnerability/CVE-2018-20788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20788 · Security Note
• https://github.com/MiCode/Xiaomi_Kernel_OpenSource/issues/973 · Note