SB2018080211 - Multiple vulnerabilities in Linux Kernel

Main Vulnerability Database SB2018080211

SB2018080211 - Multiple vulnerabilities in Linux Kernel

Published: August 2, 2018 Updated: August 7, 2018

Security Bulletin ID SB2018080211

Severity

Low

Patch available

YES

Number of vulnerabilities 10

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.

1) Use-after-free error (CVE-ID: CVE-2018-14611)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to use-after-free error in the btrfs_check_chunk_valid() function, as defined in the source code file fs/btrfs/volumes.c. A local attacker can mount a specially crafted Btrfs filesystem that submits malicious input, trigger memory corruption in the try_merge_free_space() function and cause the affected software to terminate abnormally or execute arbitrary code with elevated privileges..

Successful exploitation of the vulnerability may result in system compromise.

2) Privilege escalation (CVE-ID: CVE-2018-10901)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability existsin the Kernel-based Virtual Machine (KVM) virtualization subsystem due to the vmx.c source code file of the affected software fails to set the GDT.LIMIT value to the previous host value and instead sets it to 64 KB. A local attacker can place malicious entries in the Global Descriptor Table (GDT), submit a specially crafted request that submits malicious input and gain elevated privileges on the system.

3) Null pointer dereference (CVE-ID: CVE-2018-14614)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference in the __remove_dirty_segment() function, as defined in the source code file fs/f2fs/inode.c when mounting Flash-Friendly File System (F2FS) images. A local attacker can mount a specially crafted F2FS filesystem that submits malicious input and cause the affected software to terminate abnormally.

4) Null pointer dereference (CVE-ID: CVE-2018-14613)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the check_leaf_item() function, as defined in the source code file fs/btrfs/tree-checker.c, due to the affected software improperly validates block group items. A local attacker can mount and operate a specially crafted Btrfs filesystem that submits malicious input, trigger an invalid pointer dereference error in the io_ctl_map_page() function and cause the affected software to terminate abnormally.

5) Use-after-free error (CVE-ID: CVE-2018-14734)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to the ucma_leave_multicast() function, as defined in the drivers/infiniband/core/ucma.c source code file of the affected software, could allow access to a certain data structure after it has been allocated and freed in the ucma_process_join() function. A local attacker can send a specially request that submits malicious input, trigger use-after-free error and cause the service to crash.

6) Null pointer dereference (CVE-ID: CVE-2018-14616)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference when the fscrypt_do_page_crypto() function, as defined in the fs/crypto/crypto.c source code file of the affected software, operates on a file in a corrupted Flash-Friendly File System (F2FS) image. A local attacker can mount a malicious F2FS image on a targeted system, operat on a file in the image, and cause the software to crash.

7) Out-of-bounds read (CVE-ID: CVE-2018-14610)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the write_extent_buffer() function due to insufficient verification that each block group has a corresponding chunk at mount time in the btrfs_read_block_groups()function, as defined in fs/btrfs/extent-tree.c source code file. A local attacker can mount and operate a Btrfs filesystem image that submits malicious input, trigger an out-of-bounds read in the write_extent_buffer() function and cause the service to crash.

8) Null pointer dereference (CVE-ID: CVE-2018-14609)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the __del_reloc_root() function, as defined in the fs/btrfs/relocation.c source code file of the affected software due to an invalid pointer dereference condition that could occur when a corrupted Btrfs filesystem image is mounted. A local attacker can mount a Btrfs image that submits malicious input, trigger an invalid pointer dereference condition and cause the service to crash.

9) Buffer overflow (CVE-ID: CVE-2018-14615)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the truncate_inline_inode() function, as defined in the fs/f2fs/inline.c source code file of the affected software due to a length value may be negative during unmounting operations on a Flash-Friendly File System (F2FS) image. A local attacker can unmount an F2FS image, trigger a buffer overflow condition and cause the service to crash.

10) Null pointer dereference (CVE-ID: CVE-2018-14612)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the btrfs_root_node() function due to insufficient validation of chunk block group mappings in the btrfs_read_block_groups() function (as defined in the fs/btrfs/extent-tree.c source code file of the affected software), as well as insufficient empty-tree checks in the check_leaf() function in the fs/btrfs/tree-checker.c source code file. A local attacker can mount a B-Tree File System (Btrfs) image that submits malicious input, trigger an invalid pointer dereference condition in the btrfs_root_node() function and cause the service to crash.

Remediation

Install update from vendor's website.

References