CVE-2018-18445 — Out-of-bounds Read in Kernel

CWE-125 — Out-of-bounds Read12 documents8 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 86.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Linux KernelCanonical Ubuntu LinuxRedhat Enterprise Linux Desktop+5 more
Timeline
PublishedOct 17
Latest updateMay 13

Description

In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶NVDlinux/linux_kernel4.14.9 — 4.14.75+1
▶Debianlinux/linux_kernel< 4.18.20-1+3

Also affects: Ubuntu Linux 14.04, 16.04, 18.04, 18.10, Enterprise Linux 7.6

Patches

Patch: git.kernel.org ↗Patch: bugs.chromium.org ↗Patch: cdn.kernel.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-c3vm-qh5c-27gq: In the Linux kernel 4↗2022-05-13
▶
OSV
CVE-2018-18445: In the Linux kernel 4↗2018-10-17
▶
CVEList
CVE-2018-18445: In the Linux kernel 4↗2018-10-17
▶

📋Vendor Advisories

7
Ubuntu
Linux kernel (HWE) vulnerabilities↗2018-12-20
▶
Ubuntu
Linux kernel vulnerabilities↗2018-12-20
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2018-12-20
▶
Ubuntu
Linux kernel vulnerabilities↗2018-12-03
▶
Ubuntu
Linux kernel (AWS) vulnerabilities↗2018-11-30
▶

💬Community

1
Bugzilla
CVE-2018-18445 kernel: Faulty computation of numberic bounds in the BPF verifier↗2018-10-18
▶
CVE-2018-18445 — Out-of-bounds Read in Linux Kernel | cvebase