CVE-2018-13094 — NULL Pointer Dereference in Linux

CWE-476 — NULL Pointer Dereference19 documents7 sources
Severity
5.5MEDIUMNVD
OSV7.8OSV4.3
EPSS
0.3%
top 49.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux KernelDebian LinuxCanonical Ubuntu Linux
Timeline
PublishedJul 3
Latest updateMay 14

Description

An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶Debianlinux/linux_kernel< 4.17.14-1+3
▶Ubuntulinux/linux_kernel< 3.13.0-157.207+2
▶NVDlinux/linux_kernel4.17.3
▶debiandebian/linux< linux 4.17.14-1 (bookworm)

Also affects: Ubuntu Linux 14.04, 16.04, 18.04

Patches

Patch: git.kernel.org ↗Patch: github.com ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

8
GHSA
GHSA-c688-2x49-65h9: An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf↗2022-05-14
▶
OSV
linux-azure, linux-oem, linux-gcp vulnerabilities↗2018-08-28
▶
OSV
linux, linux-aws, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities↗2018-08-24
▶
OSV
linux vulnerabilities↗2018-08-24
▶
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities↗2018-08-24
▶

📋Vendor Advisories

8
Ubuntu
Linux kernel (Azure, GCP, OEM) vulnerabilities↗2018-08-28
▶
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities↗2018-08-24
▶
Ubuntu
Linux kernel vulnerabilities↗2018-08-24
▶
Ubuntu
Linux kernel vulnerabilities↗2018-08-24
▶
Ubuntu
Linux kernel (HWE) vulnerabilities↗2018-08-24
▶

💬Community

2
Bugzilla
CVE-2018-13094 kernel: NULL pointer dereference in xfs_da_shrink_inode function↗2018-07-03
▶
Bugzilla
CVE-2018-13094 kernel: NULL pointer dereference in xfs_da_shrink_inode function [fedora-all]↗2018-07-03
▶