CVE-2018-20169

MEDIUM
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=704620afc70cf47abb9d6a1a57f3825d2bca49cf

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.9

https://github.com/torvalds/linux/commit/704620afc70cf47abb9d6a1a57f3825d2bca49cf

https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html

https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html

https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html

https://usn.ubuntu.com/3879-1/

https://usn.ubuntu.com/3879-2/

https://usn.ubuntu.com/4094-1/

https://usn.ubuntu.com/4118-1/

Details

Source: MITRE

Published: 2018-12-17

Updated: 2019-08-13

Type: CWE-400

Risk Information

CVSS v2

Base Score: 7.2

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 3.9

Severity: HIGH

CVSS v3

Base Score: 6.8

Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 0.9

Severity: MEDIUM

Tenable Plugins

View all (43 total)

IDNameProductFamilySeverity
145665CentOS 8 : kernel (CESA-2019:3517)NessusCentOS Local Security Checks
critical
143971NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel Multiple Vulnerabilities (NS-SA-2020-0108)NessusNewStart CGSL Local Security Checks
critical
141405NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2020-0043)NessusNewStart CGSL Local Security Checks
high
141400NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2020-0041)NessusNewStart CGSL Local Security Checks
high
138171RHEL 7 : kernel (RHSA-2020:2851)NessusRed Hat Local Security Checks
high
138022RHEL 6 : kernel-rt (RHSA-2020:2777)NessusRed Hat Local Security Checks
medium
137893RHEL 7 : kernel (RHSA-2020:2770)NessusRed Hat Local Security Checks
medium
137363RHEL 7 : kernel (RHSA-2020:2522)NessusRed Hat Local Security Checks
high
135813Scientific Linux Security Update : kernel on SL7.x x86_64 (20200407)NessusScientific Linux Local Security Checks
high
135316CentOS 7 : kernel (CESA-2020:1016)NessusCentOS Local Security Checks
high
135080RHEL 7 : kernel (RHSA-2020:1016)NessusRed Hat Local Security Checks
high
135078RHEL 7 : kernel-rt (RHSA-2020:1070)NessusRed Hat Local Security Checks
high
131209Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2019-4855)NessusOracle Linux Local Security Checks
medium
131175Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4854)NessusOracle Linux Local Security Checks
medium
130547RHEL 8 : kernel (RHSA-2019:3517)NessusRed Hat Local Security Checks
critical
130526RHEL 8 : kernel-rt (RHSA-2019:3309)NessusRed Hat Local Security Checks
critical
128478Ubuntu 16.04 LTS / 18.04 LTS : linux-aws vulnerabilities (USN-4118-1)NessusUbuntu Local Security Checks
critical
127889Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4094-1)NessusUbuntu Local Security Checks
high
127613Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4729)NessusOracle Linux Local Security Checks
medium
127565OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0038)NessusOracleVM Local Security Checks
medium
125283SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1289-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)NessusSuSE Local Security Checks
high
124828EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1505)NessusHuawei Local Security Checks
critical
124595Debian DLA-1771-1 : linux-4.9 security updateNessusDebian Local Security Checks
medium
123630EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1156)NessusHuawei Local Security Checks
medium
123605EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-1131)NessusHuawei Local Security Checks
medium
123420Debian DLA-1731-2 : linux regression update (Spectre)NessusDebian Local Security Checks
medium
123121EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-1108)NessusHuawei Local Security Checks
medium
122891SUSE SLES11 Security Update : kernel (SUSE-SU-2019:13979-1)NessusSuSE Local Security Checks
high
122609SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:0541-1)NessusSuSE Local Security Checks
high
122343SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0439-1)NessusSuSE Local Security Checks
high
121633openSUSE Security Update : the Linux Kernel (openSUSE-2019-140)NessusSuSE Local Security Checks
high
121597Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws vulnerabilities (USN-3879-2)NessusUbuntu Local Security Checks
medium
121596Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities (USN-3879-1)NessusUbuntu Local Security Checks
medium
121571SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:0224-1)NessusSuSE Local Security Checks
high
121569SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0222-1) (Spectre)NessusSuSE Local Security Checks
high
121505Slackware 14.2 : Slackware 14.2 kernel (SSA:2019-030-01)NessusSlackware Local Security Checks
high
121468SUSE SLES11 Security Update : kernel (SUSE-SU-2019:13937-1)NessusSuSE Local Security Checks
high
121466SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:0196-1)NessusSuSE Local Security Checks
high
121344SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0148-1) (Spectre)NessusSuSE Local Security Checks
high
121289openSUSE Security Update : the Linux Kernel (openSUSE-2019-65)NessusSuSE Local Security Checks
high
121130Amazon Linux AMI : kernel (ALAS-2019-1145)NessusAmazon Linux Local Security Checks
medium
121054Amazon Linux 2 : kernel (ALAS-2019-1145)NessusAmazon Linux Local Security Checks
medium
120513Fedora 28 : kernel / kernel-headers / kernel-tools (2018-6e8c330d50)NessusFedora Local Security Checks
medium