CVE-2018-14619
published 2018-08-30CVE-2018-14619: A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was…
PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.43%
35.4th percentile
A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This can cause the null skcipher to be freed while it is still in use leading to a local user being able to crash the system or possibly escalate privileges.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.14.12-1 (bookworm) | linux 4.14.12-1 (bookworm) |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 4.14.12-1 | 4.14.12-1 |
| linux | linux_kernel | >= 0 < 4.14.12-1 | 4.14.12-1 |
| linux | linux_kernel | >= 0 < 4.14.12-1 | 4.14.12-1 |
| linux | linux_kernel | >= 0 < 4.14.12-1 | 4.14.12-1 |
| linux | linux_kernel | >= 4.14 < 4.14.8 | 4.14.8 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.06.2MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: crash (possible privesc) in kernel crypto api.
vendor_redhat·2018-08-28·CVSS 7.8
CVE-2018-14619 [HIGH] CWE-416 kernel: crash (possible privesc) in kernel crypto api.
kernel: crash (possible privesc) in kernel crypto api.
A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This can cause the null skcipher to be freed while it is still in use leading to a local user being able to crash the system or possibly escalate privileges.
A flaw was found in the crypto subsystem that allowed an attacker
to crash the system or possibly escalate privileges with a specially crafted program.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) -
Debian
CVE-2018-14619: linux - A flaw was found in the crypto subsystem of the Linux kernel before version kern...
vendor_debian·2018·CVSS 7.8
CVE-2018-14619 [HIGH] CVE-2018-14619: linux - A flaw was found in the crypto subsystem of the Linux kernel before version kern...
A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This can cause the null skcipher to be freed while it is still in use leading to a local user being able to crash the system or possibly escalate privileges.
Scope: local
bookworm: resolved (fixed in 4.14.12-1)
bullseye: resolved (fixed in 4.14.12-1)
forky: resolved (fixed in 4.14.12-1)
sid: resolved (fixed in 4.14.12-1)
trixie: resolved (fixed in 4.14.12-1)
GHSA
GHSA-r8cr-q337-j896: A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4
ghsa_unreviewed·2022-05-13
CVE-2018-14619 [HIGH] CWE-20 GHSA-r8cr-q337-j896: A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4
A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This can cause the null skcipher to be freed while it is still in use leading to a local user being able to crash the system or possibly escalate privileges.
OSV
CVE-2018-14619: A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4
osv·2018-08-30·CVSS 7.8
CVE-2018-14619 [HIGH] CVE-2018-14619: A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4
A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This can cause the null skcipher to be freed while it is still in use leading to a local user being able to crash the system or possibly escalate privileges.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto api. [fedora-all]
bugzilla·2018-08-28·CVSS 7.8
CVE-2018-14619 [HIGH] CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto api. [fedora-all]
CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto api. [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ver
Bugzilla
CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto api.
bugzilla·2018-08-24·CVSS 7.8
CVE-2018-14619 [HIGH] CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto api.
CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto api.
A flaw was found in the crypto subsystem of the Linux kernel.
The "null skcipher" was being by dropped in the wrong place -- when each af_alg_ctx was freed instead of when the aead_tfm was freed. This can cause the null skcipher to be freed while it is still in use.
This may grant a local user to be able to crash the machine and possible corrupt memory leading to privilege escalation.
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b32a7dc8aef1882fbf983eb354837488cc9d54dc
Discussion:
External References:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b32a7dc8aef1882fbf983eb354837488cc9d54dc
---
Created kernel tracking bugs for this iss
http://www.securityfocus.com/bid/105200https://access.redhat.com/errata/RHSA-2018:2948https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14619https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b32a7dc8aef1882fbf983eb354837488cc9d54dchttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0013http://www.securityfocus.com/bid/105200https://access.redhat.com/errata/RHSA-2018:2948https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14619https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b32a7dc8aef1882fbf983eb354837488cc9d54dchttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0013
2018-08-30
Published