CVE-2018-10879

MEDIUM

Description

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image.

References

http://patchwork.ozlabs.org/patch/928666/

http://patchwork.ozlabs.org/patch/928667/

http://www.securityfocus.com/bid/104902

https://access.redhat.com/errata/RHSA-2018:2948

https://access.redhat.com/errata/RHSA-2018:3083

https://access.redhat.com/errata/RHSA-2018:3096

https://bugzilla.kernel.org/show_bug.cgi?id=200001

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10879

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=513f86d73855ce556ea9522b6bfd79f87356dc3a

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5369a762c882c0b6e9599e4ebbb3a9ba9eee7e2d

https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html

https://usn.ubuntu.com/3753-1/

https://usn.ubuntu.com/3753-2/

https://usn.ubuntu.com/3871-1/

https://usn.ubuntu.com/3871-3/

https://usn.ubuntu.com/3871-4/

https://usn.ubuntu.com/3871-5/

Details

Source: MITRE

Published: 2018-07-26

Updated: 2019-03-05

Type: CWE-416

Risk Information

CVSS v2.0

Base Score: 6.1

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:C

Impact Score: 8.5

Exploitability Score: 3.9

Severity: MEDIUM

CVSS v3.0

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1.8

Severity: HIGH

Vulnerable Software

ID	Name	Product	Family	Severity
122052	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : linux-azure vulnerabilities (USN-3871-5)	Nessus	Ubuntu Local Security Checks	high
122007	Photon OS 2.0: Linux PHSA-2018-2.0-0109	Nessus	PhotonOS Local Security Checks	high
121890	Photon OS 1.0: Linux PHSA-2018-1.0-0188	Nessus	PhotonOS Local Security Checks	medium
121594	Ubuntu 16.04 LTS : linux-hwe, linux-aws-hwe, linux-gcp vulnerabilities (USN-3871-4)	Nessus	Ubuntu Local Security Checks	high
121593	Ubuntu 18.04 LTS : linux-aws, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities (USN-3871-3)	Nessus	Ubuntu Local Security Checks	high
121592	Ubuntu 18.04 LTS : linux regression (USN-3871-2)	Nessus	Ubuntu Local Security Checks	high
121469	Ubuntu 18.04 LTS : linux vulnerabilities (USN-3871-1)	Nessus	Ubuntu Local Security Checks	high
120082	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2380-1) (Foreshadow)	Nessus	SuSE Local Security Checks	high
119187	Scientific Linux Security Update : kernel on SL7.x x86_64	Nessus	Scientific Linux Local Security Checks	high
118990	CentOS 7 : kernel (CESA-2018:3083)	Nessus	CentOS Local Security Checks	high
118770	Oracle Linux 7 : kernel (ELSA-2018-3083)	Nessus	Oracle Linux Local Security Checks	high
118528	RHEL 7 : kernel-rt (RHSA-2018:3096)	Nessus	Red Hat Local Security Checks	high
118525	RHEL 7 : kernel (RHSA-2018:3083)	Nessus	Red Hat Local Security Checks	high
118513	RHEL 7 : kernel-alt (RHSA-2018:2948) (Spectre)	Nessus	Red Hat Local Security Checks	high
118034	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:3084-1)	Nessus	SuSE Local Security Checks	high
118033	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:3083-1)	Nessus	SuSE Local Security Checks	high
117881	Photon OS 1.0: Linux PHSA-2018-1.0-0188 (deprecated)	Nessus	PhotonOS Local Security Checks	medium
117824	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2908-1)	Nessus	SuSE Local Security Checks	high
117800	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2858-1)	Nessus	SuSE Local Security Checks	high
117629	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:2776-1)	Nessus	SuSE Local Security Checks	high
112112	Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws vulnerabilities (USN-3753-2)	Nessus	Ubuntu Local Security Checks	high
112111	Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities (USN-3753-1)	Nessus	Ubuntu Local Security Checks	high
111997	openSUSE Security Update : the Linux Kernel (openSUSE-2018-885) (Foreshadow)	Nessus	SuSE Local Security Checks	high
111812	openSUSE Security Update : the Linux Kernel (openSUSE-2018-886) (Foreshadow)	Nessus	SuSE Local Security Checks	high
111165	Debian DLA-1423-1 : linux-4.9 new package (Spectre)	Nessus	Debian Local Security Checks	high