CVE-2018-11506
published 2018-05-28CVE-2018-11506: The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer…
PriorityP335high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.39%
31.3th percentile
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 4.16.16-1 (bookworm) | linux 4.16.16-1 (bookworm) |
| linux | linux_kernel | >= 0 < 4.16.16-1 | 4.16.16-1 |
| linux | linux_kernel | >= 0 < 4.16.16-1 | 4.16.16-1 |
| linux | linux_kernel | >= 0 < 4.16.16-1 | 4.16.16-1 |
| linux | linux_kernel | >= 0 < 4.16.16-1 | 4.16.16-1 |
| linux | linux_kernel | >= 0 < 4.15.0-33.36 | 4.15.0-33.36 |
| linux | linux_kernel | >= 4.11 < 4.14.45 | 4.14.45 |
| linux | linux_kernel | >= 4.15 < 4.16.13 | 4.16.13 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gq53-r8v6-47q9: The sr_do_ioctl function in drivers/scsi/sr_ioctl
ghsa_unreviewed·2022-05-13
CVE-2018-11506 [HIGH] CWE-787 GHSA-gq53-r8v6-47q9: The sr_do_ioctl function in drivers/scsi/sr_ioctl
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.
OSV
linux-azure, linux-oem, linux-gcp vulnerabilities
osv·2018-08-28·CVSS 5.5
CVE-2018-1000200 [MEDIUM] linux-azure, linux-oem, linux-gcp vulnerabilities
linux-azure, linux-oem, linux-gcp vulnerabilities
It was discovered that, when attempting to handle an out-of-memory
situation, a null pointer dereference could be triggered in the Linux
kernel in some circumstances. A local attacker could use this to cause a
denial of service (system crash). (CVE-2018-1000200)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly validate meta-data information. An attacker could
use this to construct a malicious xfs image that, when mounted, could cause
a denial of service (system crash). (CVE-2018-10323)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly validate xattr information. An attacker could use
this to construct a malicious xfs image that, when mounted, could c
OSV
linux, linux-aws, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities
osv·2018-08-24·CVSS 5.5
CVE-2018-1000200 [MEDIUM] linux, linux-aws, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities
linux, linux-aws, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities
It was discovered that, when attempting to handle an out-of-memory
situation, a null pointer dereference could be triggered in the Linux
kernel in some circumstances. A local attacker could use this to cause a
denial of service (system crash). (CVE-2018-1000200)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly validate meta-data information. An attacker could
use this to construct a malicious xfs image that, when mounted, could cause
a denial of service (system crash). (CVE-2018-10323)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly validate xattr information. An attacker could use
this to construct a malicious xfs image that, wh
OSV
linux-hwe vulnerabilities
osv·2018-08-24·CVSS 5.5
CVE-2018-10002 [MEDIUM] linux-hwe vulnerabilities
linux-hwe vulnerabilities
USN-3752-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS.
It was discovered that, when attempting to handle an out-of-memory
situation, a null pointer dereference could be triggered in the Linux
kernel in some circumstances. A local attacker could use this to cause a
denial of service (system crash). (CVE-2018-1000200)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly validate meta-data information. An attacker could
use this to construct a malicious xfs image that, when mounted, could cause
a denial of service (system crash). (CVE-2018-10323)
Wen Xu discovered tha
OSV
CVE-2018-11506: The sr_do_ioctl function in drivers/scsi/sr_ioctl
osv·2018-05-28·CVSS 7.8
CVE-2018-11506 [HIGH] CVE-2018-11506: The sr_do_ioctl function in drivers/scsi/sr_ioctl
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.
Ubuntu
Linux kernel (Azure, GCP, OEM) vulnerabilities
vendor_ubuntu·2018-08-28·CVSS 5.5
CVE-2018-1000200 [MEDIUM] Linux kernel (Azure, GCP, OEM) vulnerabilities
Title: Linux kernel (Azure, GCP, OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that, when attempting to handle an out-of-memory
situation, a null pointer dereference could be triggered in the Linux
kernel in some circumstances. A local attacker could use this to cause a
denial of service (system crash). (CVE-2018-1000200)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly validate meta-data information. An attacker could
use this to construct a malicious xfs image that, when mounted, could cause
a denial of service (system crash). (CVE-2018-10323)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly validate xattr information. An attacker could u
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-08-24·CVSS 5.5
CVE-2018-1000200 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that, when attempting to handle an out-of-memory
situation, a null pointer dereference could be triggered in the Linux
kernel in some circumstances. A local attacker could use this to cause a
denial of service (system crash). (CVE-2018-1000200)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly validate meta-data information. An attacker could
use this to construct a malicious xfs image that, when mounted, could cause
a denial of service (system crash). (CVE-2018-10323)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly validate xattr information. An attacker could use
this to constru
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2018-08-24·CVSS 5.5
CVE-2018-1000200 [MEDIUM] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3752-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS.
It was discovered that, when attempting to handle an out-of-memory
situation, a null pointer dereference could be triggered in the Linux
kernel in some circumstances. A local attacker could use this to cause a
denial of service (system crash). (CVE-2018-1000200)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly validate meta-data information. An attacker could
use this to construct a malicious xfs image that, when mounted, could
Red Hat
kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact
vendor_redhat·2018-05-21·CVSS 7.8
CVE-2018-11506 [HIGH] CWE-121 kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact
kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel allows local users to cause a denial of service via a stack-based buffer overflow or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Pack
Debian
CVE-2018-11506: linux - The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through ...
vendor_debian·2018·CVSS 7.8
CVE-2018-11506 [HIGH] CVE-2018-11506: linux - The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through ...
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.
Scope: local
bookworm: resolved (fixed in 4.16.16-1)
bullseye: resolved (fixed in 4.16.16-1)
forky: resolved (fixed in 4.16.16-1)
sid: resolved (fixed in 4.16.16-1)
trixie: resolved (fixed in 4.16.16-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-5747 busybox: Out of bounds read in udhcp components resulting in information disclosure
bugzilla·2019-01-17·CVSS 7.5
CVE-2019-5747 [HIGH] CVE-2019-5747 busybox: Out of bounds read in udhcp components resulting in information disclosure
CVE-2019-5747 busybox: Out of bounds read in udhcp components resulting in information disclosure
An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET.
NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.
Upstream issue:
https://bugs.busybox.net/show_bug.cgi?id=11506
Upstream patch:
https://git.busybox.net/busybox/commit/?id=74d9f1ba37010face4bd1449df4d60dd84450b06
Discussion:
Created busybox tracking bugs for this issue:
Affects: fedora-all [bug 1667069]
---
Statement:
This issue did not
Bugzilla
CVE-2018-20679 busybox: Out of bounds read in udhcp components resulting in information disclosure
bugzilla·2019-01-16·CVSS 7.5
CVE-2018-20679 [HIGH] CVE-2018-20679 busybox: Out of bounds read in udhcp components resulting in information disclosure
CVE-2018-20679 busybox: Out of bounds read in udhcp components resulting in information disclosure
An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.
Upstream issue:
https://bugs.busybox.net/show_bug.cgi?id=11506
Upstream patch:
https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1acf8df85382ff562c
Discussion:
Created busybox tracking bugs for this issue:
Affects: fedora-all [bug 1666668]
---
Statement:
This issue did not affect the versions of busybox a
Bugzilla
CVE-2018-11506 kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact
bugzilla·2018-05-28·CVSS 7.8
CVE-2018-11506 [HIGH] CVE-2018-11506 kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact
CVE-2018-11506 kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel allows local users to cause a denial of service via a stack-based buffer overflow or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer.
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f7068114d45ec55996b9040e98111afa56e010fe
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1583213]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:2948 https://access.redhat.com/errata/RHSA-2018:29
Bugzilla
CVE-2018-11506 kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact [fedora-all]
bugzilla·2018-05-28·CVSS 7.8
CVE-2018-11506 [HIGH] CVE-2018-11506 kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact [fedora-all]
CVE-2018-11506 kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg com
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f7068114d45ec55996b9040e98111afa56e010fehttps://access.redhat.com/errata/RHSA-2018:2948https://github.com/torvalds/linux/commit/f7068114d45ec55996b9040e98111afa56e010fehttps://lists.debian.org/debian-lts-announce/2018/07/msg00015.htmlhttps://lists.debian.org/debian-lts-announce/2018/07/msg00016.htmlhttps://lists.debian.org/debian-lts-announce/2018/07/msg00020.htmlhttps://twitter.com/efrmv/status/1001574894273007616https://usn.ubuntu.com/3752-1/https://usn.ubuntu.com/3752-2/https://usn.ubuntu.com/3752-3/http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f7068114d45ec55996b9040e98111afa56e010fehttps://access.redhat.com/errata/RHSA-2018:2948https://github.com/torvalds/linux/commit/f7068114d45ec55996b9040e98111afa56e010fehttps://lists.debian.org/debian-lts-announce/2018/07/msg00015.htmlhttps://lists.debian.org/debian-lts-announce/2018/07/msg00016.htmlhttps://lists.debian.org/debian-lts-announce/2018/07/msg00020.htmlhttps://twitter.com/efrmv/status/1001574894273007616https://usn.ubuntu.com/3752-1/https://usn.ubuntu.com/3752-2/https://usn.ubuntu.com/3752-3/
2018-05-28
Published