CVE-2018-7191
published 2019-05-17CVE-2018-7191: In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial…
PriorityP420medium5.5CVSS 3.0
AVLACLPRLUINSUCNINAH
EPSS
0.65%
47.8th percentile
In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.14.2-1 (bookworm) | linux 4.14.2-1 (bookworm) |
| linux | linux_kernel | < 4.13.14 | 4.13.14 |
| linux | linux_kernel | >= 0 < 4.14.2-1 | 4.14.2-1 |
| linux | linux_kernel | >= 0 < 4.14.2-1 | 4.14.2-1 |
| linux | linux_kernel | >= 0 < 4.14.2-1 | 4.14.2-1 |
| linux | linux_kernel | >= 0 < 4.14.2-1 | 4.14.2-1 |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv6.9MEDIUM
vendor_redhat9.8CRITICAL
vendor_debian6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p54q-624c-fr42: In the tun subsystem in the Linux kernel before 4
ghsa_unreviewed·2022-05-24·CVSS 6.9
CVE-2018-7191 [MEDIUM] GHSA-p54q-624c-fr42: In the tun subsystem in the Linux kernel before 4
In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.
OSV
CVE-2018-7191: In the tun subsystem in the Linux kernel before 4
osv·2019-05-17·CVSS 6.9
CVE-2018-7191 [MEDIUM] CVE-2018-7191: In the tun subsystem in the Linux kernel before 4
In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.
Red Hat
irssi: use-after-free when a server is disconnected during netsplits
vendor_redhat·2018-02-15·CVSS 9.8
CVE-2018-7054 [CRITICAL] CWE-416 irssi: use-after-free when a server is disconnected during netsplits
irssi: use-after-free when a server is disconnected during netsplits
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when a server is disconnected during netsplits. NOTE: this issue exists because of an incomplete fix for CVE-2017-7191.
Statement: This issue did not affect the versions of Irssi as shipped with Red Hat Enterprise Linux 6 and 7, since the affected code was introduced in Irssi version 1.0.0.
Package: irssi (Red Hat Enterprise Linux 6) - Not affected
Package: irssi (Red Hat Enterprise Linux 7) - Not affected
Package: irssi (Red Hat Enterprise Linux 8) - Not affected
Red Hat
kernel: denial of service via ioctl call in network tun handling
vendor_redhat·2018-01-17·CVSS 6.9
CVE-2018-7191 [MEDIUM] CWE-400 kernel: denial of service via ioctl call in network tun handling
kernel: denial of service via ioctl call in network tun handling
In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.
A flaw was found in the Linux kernel's implementation of networking tunnel device ioctl. A local attacker can cause a denial of service (NULL pointer dereference and panic) via an ioctl (TUNSETIFF) call with a dev name containing a / character.
Package: kernel (Red Hat Enterprise Linux 5) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 6) - Will not fix
Package: kernel-alt (Red Hat Enterprise Linux
Debian
CVE-2018-7191: linux - In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is n...
vendor_debian·2018·CVSS 6.9
CVE-2018-7191 [MEDIUM] CVE-2018-7191: linux - In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is n...
In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.
Scope: local
bookworm: resolved (fixed in 4.14.2-1)
bullseye: resolved (fixed in 4.14.2-1)
forky: resolved (fixed in 4.14.2-1)
sid: resolved (fixed in 4.14.2-1)
trixie: resolved (fixed in 4.14.2-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-7191 kernel: denial of service via ioctl call in network tun handling
bugzilla·2019-06-03·CVSS 5.5
CVE-2018-7191 [MEDIUM] CVE-2018-7191 kernel: denial of service via ioctl call in network tun handling
CVE-2018-7191 kernel: denial of service via ioctl call in network tun handling
In the tun subsystem in the Linux kernel, a local attacker could issue an ioctl to call dev_get_valid_name which is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character.
Reference:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1743792
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.14
Commits:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0ad646c81b2182f7fa67ec0c8c825e0ee165696d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5c25f65fd1e42685f7ccd80e0621829c105785d9
Discussion:
Note: I
arXiv
Similar but Patched Code Considered Harmful -- The Impact of Similar but Patched Code on Recurring Vulnerability Detection and How to Remove Them
arxiv_fulltext·2024-12-30
Similar but Patched Code Considered Harmful -- The Impact of Similar but Patched Code on Recurring Vulnerability Detection and How to Remove Them
Similar but Patched Code Considered Harmful
0.3cm
The Impact of Similar but Patched Code on Recurring Vulnerability Detection
0.05cm
and How to Remove Them
@IEEEauthorhalign
@IEEEauthorhalign
Zixuan Tan2,
Jiayuan Zhou3,
Xing Hu21 1Corresponding author,
Shengyi Pan2,
Kui Liu4,
Xin Xia4
2Zhejiang University, Hangzhou, Zhejiang, China
3Centre for Software Excellence, Huawei, Toronto, Canada
4Huawei, Hangzhou, Zhejiang, China
\tanzixuan, xinghu, shengyi.pan\@zju.edu.cn,
[email protected],
[email protected],
[email protected]
## Abstract
Identifying recurring vulnerabilities is crucial for ensuring software security.
Clone-based techniques, while widely used, often generate many false alarms due to the existence of similar but patched (SBP) code, which is similar to vulnerable
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.htmlhttp://www.securityfocus.com/bid/108380https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1743792https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1748846https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.14https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0ad646c81b2182f7fa67ec0c8c825e0ee165696dhttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5c25f65fd1e42685f7ccd80e0621829c105785d9https://github.com/torvalds/linux/commit/0ad646c81b2182f7fa67ec0c8c825e0ee165696dhttps://github.com/torvalds/linux/commit/5c25f65fd1e42685f7ccd80e0621829c105785d9http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.htmlhttp://www.securityfocus.com/bid/108380https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1743792https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1748846https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.14https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0ad646c81b2182f7fa67ec0c8c825e0ee165696dhttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5c25f65fd1e42685f7ccd80e0621829c105785d9https://github.com/torvalds/linux/commit/0ad646c81b2182f7fa67ec0c8c825e0ee165696dhttps://github.com/torvalds/linux/commit/5c25f65fd1e42685f7ccd80e0621829c105785d9
2019-05-17
Published