CVE-2018-10087 — Improper Input Validation in Kernel

CWE-20 — Improper Input ValidationCWE-190 — Integer Overflow or Wraparound14 documents7 sources
Severity
5.5MEDIUMNVD
OSV7.8OSV7.5OSV4.3
EPSS
0.1%
top 77.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Linux KernelLibpngDebian Linux+2 more
Timeline
PublishedApr 13
Latest updateMay 14

Description

The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶NVDlinux/linux_kernel< 4.13
▶Debianlinux/linux_kernel< 4.13.4-1+3
▶Ubuntulinux/linux_kernel< 3.13.0-157.207+1
▶debiandebian/linux< linux 4.13.4-1 (bookworm)
▶Ubuntulibpng/libpng< 1.2.50-1ubuntu2.14.04.3+1

Also affects: Debian Linux 8.0, Ubuntu Linux 14.04, 16.04

Patches

Patch: git.kernel.org ↗Patch: github.com ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

6
GHSA
GHSA-qg3j-cf78-6fp3: The kernel_wait4 function in kernel/exit↗2022-05-14
▶
OSV
linux vulnerabilities↗2018-08-24
▶
OSV
libpng, libpng1.6 vulnerabilities↗2018-07-11
▶
OSV
linux-lts-xenial, linux-aws vulnerabilities↗2018-07-02
▶
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities↗2018-07-02
▶

📋Vendor Advisories

5
Ubuntu
Linux kernel vulnerabilities↗2018-08-24
▶
Ubuntu
Linux kernel vulnerabilities↗2018-07-02
▶
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities↗2018-07-02
▶
Debian
CVE-2018-10087: linux - The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when...↗2018
▶
Red Hat
kernel: Undefined behavior in kernel/exit.c:kernel_wait4() function allows local denial of service↗2017-07-11
▶

💬Community

2
Bugzilla
CVE-2018-10087 kernel: Undefined behavior in kernel/exit.c:kernel_wait4() function allows local denial of service [fedora-all]↗2018-04-20
▶
Bugzilla
CVE-2018-10087 kernel: Undefined behavior in kernel/exit.c:kernel_wait4() function allows local denial of service↗2018-04-16
▶