CVE-2018-9363 — Integer Overflow or Wraparound in Kernel

CWE-190 — Integer Overflow or WraparoundCWE-787 — Out-of-bounds WriteCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer18 documents10 sources
Severity
8.4HIGHNVD
EPSS
0.0%
top 85.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Linux KernelGoogle INC AndroidCanonical Ubuntu Linux+1 more
Timeline
PublishedNov 6
Latest updateMay 13

Description

In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-65853588 References: Upstream kernel.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.5 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5google_inc/androidAndroid kernel
▶NVDlinux/linux_kernel3.14 — 3.16.58+6
▶Debianlinux/linux_kernel< 4.17.15-1+3

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 12.04, 14.04, 16.04, 18.04

🔴Vulnerability Details

5
GHSA
GHSA-4jqv-ffjp-jw6v: In the hidp_process_report in bluetooth, there is an integer overflow↗2022-05-13
▶
CVEList
CVE-2018-9363: In the hidp_process_report in bluetooth, there is an integer overflow↗2018-11-06
▶
OSV
CVE-2018-9363: In the hidp_process_report in bluetooth, there is an integer overflow↗2018-11-06
▶
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities↗2018-10-23
▶
Kernel
Bluetooth: hidp: buffer overflow in hidp_process_report↗2018-07-31
▶

📋Vendor Advisories

10
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities↗2018-11-14
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2018-11-14
▶
Ubuntu
Linux kernel vulnerabilities↗2018-11-14
▶
Ubuntu
Linux kernel vulnerabilities↗2018-11-14
▶
Ubuntu
Linux kernel (HWE) vulnerabilities↗2018-11-14
▶

💬Community

2
Bugzilla
CVE-2018-9363 kernel: Buffer overflow in hidp_process_report [fedora-all]↗2018-08-28
▶
Bugzilla
CVE-2018-9363 kernel: Buffer overflow in hidp_process_report↗2018-08-28
▶
CVE-2018-9363 — Integer Overflow or Wraparound | cvebase