Red Hat update for kernel-alt
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-13095 |
| CWE-ID | CWE-476 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
Red Hat Enterprise Linux for IBM System z (Structure A) Operating systems & Components / Operating system Red Hat Enterprise Linux for Power 9 Operating systems & Components / Operating system Red Hat Enterprise Linux for ARM 64 Operating systems & Components / Operating system kernel-alt (Red Hat package) Operating systems & Components / Operating system package or component Other |
| Vendor |
Red Hat Inc. |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Null pointer dereference
EUVDB-ID: #VU13851
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-13095
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists in the xfs_bmap_extents_to_btree() function in the Extended File System (XFS) component, as defined in the source code file fs/xfs/libxfs/xfs_inode_buf.c due to boundary error when mounting XFS filesystems. A local attacker can access the system, mount an XFS filesystem that submits malicious input, trigger a NULL pointer dereference memory error and cause the affected software to terminate abnormally.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for IBM System z (Structure A): 7.0
Red Hat Enterprise Linux for Power 9: 7.0
Red Hat Enterprise Linux for ARM 64: 7.0
kernel-alt (Red Hat package): 4.14.0-49.el7a - 4.14.0-115.7.1.el7a
:
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_system_z_structure_a:7.0:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_9:7.0:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64:7.0:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:kernel-alt_redhat_package:4.14.0-49.el7a:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:kernel-alt_redhat_package:4.14.0-49.2.2.el7a:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:kernel-alt_redhat_package:4.14.0-49.8.1.el7a:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:::::*:*:*:*:*:*:*
https://access.redhat.com/errata/RHSA-2019:1350
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
