cbcvebase.
CVE-2018-18559
published 2018-10-22

CVE-2018-18559: In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This…

high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.

Affected

21 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 4.14.7-1 (bookworm)linux 4.14.7-1 (bookworm)
linuxlinux_kernel>= 0 < 4.14.7-14.14.7-1
linuxlinux_kernel>= 0 < 4.14.7-14.14.7-1
linuxlinux_kernel>= 0 < 4.14.7-14.14.7-1
linuxlinux_kernel>= 0 < 4.14.7-14.14.7-1
linuxlinux_kernel>= 3.14.58 < 3.153.15
linuxlinux_kernel>= 3.18.25 < 3.18.883.18.88
linuxlinux_kernel>= 3.2.95 < 3.2.1003.2.100
linuxlinux_kernel>= 4.1.14 < 4.1.494.1.49
linuxlinux_kernel>= 4.10 < 4.14.74.14.7
linuxlinux_kernel>= 4.2.7 < 4.34.3
linuxlinux_kernel>= 4.3.1 < 4.4.1064.4.106
linuxlinux_kernel>= 4.5 < 4.9.704.9.70
redhatenterprise_linux_desktop
redhatenterprise_linux_server
redhatenterprise_linux_server_aus
redhatenterprise_linux_server_eus
redhatenterprise_linux_server_tus
redhatenterprise_linux_workstation
redhatopenshift_container_platform
redhatvirtualization_host

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
osv8.1HIGH