CVE-2018-9568
published 2018-12-06CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.71%
49.6th percentile
In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 4.13.10-1 (bookworm) | linux 4.13.10-1 (bookworm) |
| android | — | — | |
| google_inc | android | — | — |
| linux | linux_kernel | < 3.10.108 | 3.10.108 |
| linux | linux_kernel | >= 0 < 4.13.10-1 | 4.13.10-1 |
| linux | linux_kernel | >= 0 < 4.13.10-1 | 4.13.10-1 |
| linux | linux_kernel | >= 0 < 4.13.10-1 | 4.13.10-1 |
| linux | linux_kernel | >= 0 < 4.13.10-1 | 4.13.10-1 |
| linux | linux_kernel | >= 0 < 3.13.0-165.215 | 3.13.0-165.215 |
| linux | linux_kernel | >= 3.11 < 3.16.58 | 3.16.58 |
| linux | linux_kernel | >= 3.17 < 3.18.77 | 3.18.77 |
| linux | linux_kernel | >= 3.19 < 4.1.46 | 4.1.46 |
| linux | linux_kernel | >= 4.10 < 4.13.6 | 4.13.6 |
| linux | linux_kernel | >= 4.2 < 4.4.94 | 4.4.94 |
| linux | linux_kernel | >= 4.5 < 4.9.55 | 4.9.55 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8hfc-fgjc-59xp: In sk_clone_lock of sock
ghsa_unreviewed·2022-05-13
CVE-2018-9568 [HIGH] CWE-704 GHSA-8hfc-fgjc-59xp: In sk_clone_lock of sock
In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel.
Project0
In-the-Wild Series: Android Exploits - Project Zero
project_zero·2021-01-01·CVSS 7.8
CVE-2015-0569 [HIGH] In-the-Wild Series: Android Exploits - Project Zero
This is part 4 of a 6-part series detailing a set of vulnerabilities found by Project Zero being exploited in the wild. To read the other parts of the series, see the introduction post.
Posted by Mark Brand, Project Zero
A survey of the exploitation techniques used by a high-tier attacker against Android devices in 2020
## Introduction
After one of the Chrome exploits has been successful, there are several (quite simple) stages of payload decryption that occur. Once we've got through that, we reach a much more complex binary that is clearly the result of some engineering work. Thanks to that engineering it's very simple for us to locate and examine the exploits embedded inside! For each privilege elevation, they have a function in the .init_array which will register it into a global
Kernel
mm/slab: validate cache membership under freelist hardening
kernel_security·2019-07-11·CVSS 7.8
CVE-2018-9568 [HIGH] mm/slab: validate cache membership under freelist hardening
mm/slab: validate cache membership under freelist hardening
Patch series "mm/slab: Improved sanity checking".
This adds defenses against slab cache confusion (as seen in real-world
exploits[1]) and gracefully handles type confusions when trying to look
up slab caches from an arbitrary page. (Also is patch 3: new LKDTM
tests for these defenses as well as for the existing double-free
detection.
This patch (of 3):
When building under CONFIG_SLAB_FREELIST_HARDENING, it makes sense to
perform sanity-checking on the assumed slab cache during
kmem_cache_free() to make sure the kernel doesn't mix freelists across
slab caches and corrupt memory (as seen in the exploitation of flaws
like CVE-2018-9568[1]). Note that the prior code might WARN() but still
corrupt memory (i.e. return the assumed ca
OSV
linux vulnerabilities
osv·2019-02-04·CVSS 6.5
CVE-2018-1066 [MEDIUM] linux vulnerabilities
linux vulnerabilities
It was discovered that the CIFS client implementation in the Linux kernel
did not properly handle setup negotiation during session recovery, leading
to a NULL pointer exception. An attacker could use this to create a
malicious CIFS server that caused a denial of service (client system
crash). (CVE-2018-1066)
Jann Horn discovered that the procfs file system implementation in the
Linux kernel did not properly restrict the ability to inspect the kernel
stack of an arbitrary task. A local attacker could use this to expose
sensitive information. (CVE-2018-17972)
Jann Horn discovered that the mremap() system call in the Linux kernel did
not properly flush the TLB when completing, potentially leaving access to a
physical page after it has been released to the page allocat
OSV
CVE-2018-9568: In sk_clone_lock of sock
osv·2018-12-06·CVSS 7.8
CVE-2018-9568 [HIGH] CVE-2018-9568: In sk_clone_lock of sock
In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel.
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2019-02-04·CVSS 6.5
CVE-2018-1066 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3880-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 ESM.
It was discovered that the CIFS client implementation in the Linux kernel
did not properly handle setup negotiation during session recovery, leading
to a NULL pointer exception. An attacker could use this to create a
malicious CIFS server that caused a denial of service (client system
crash). (CVE-2018-1066)
Jann Horn discovered that the procfs file system implementation in the
Linux kernel did not properly restrict the ability to inspect the kernel
stack of an arb
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-02-04·CVSS 6.5
CVE-2018-1066 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the CIFS client implementation in the Linux kernel
did not properly handle setup negotiation during session recovery, leading
to a NULL pointer exception. An attacker could use this to create a
malicious CIFS server that caused a denial of service (client system
crash). (CVE-2018-1066)
Jann Horn discovered that the procfs file system implementation in the
Linux kernel did not properly restrict the ability to inspect the kernel
stack of an arbitrary task. A local attacker could use this to expose
sensitive information. (CVE-2018-17972)
Jann Horn discovered that the mremap() system call in the Linux kernel did
not properly flush the TLB when completing, potentially
Android
CVE-2018-9568: network
vendor_android·2018-12-01·CVSS 7.8
CVE-2018-9568 [HIGH] CVE-2018-9568: network
Android Security Bulletin 2018-12-01
CVE: CVE-2018-9568
Severity: HIGH
Type: EoP
Component: network
References: A-113509306
Upstream kernel
Debian
CVE-2018-9568: linux - In sk_clone_lock of sock.c, there is a possible memory corruption due to type co...
vendor_debian·2018·CVSS 7.8
CVE-2018-9568 [HIGH] CVE-2018-9568: linux - In sk_clone_lock of sock.c, there is a possible memory corruption due to type co...
In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel.
Scope: local
bookworm: resolved (fixed in 4.13.10-1)
bullseye: resolved (fixed in 4.13.10-1)
forky: resolved (fixed in 4.13.10-1)
sid: resolved (fixed in 4.13.10-1)
trixie: resolved (fixed in 4.13.10-1)
Red Hat
kernel: Memory corruption due to incorrect socket cloning
vendor_redhat·2017-09-28·CVSS 7.8
CVE-2018-9568 [HIGH] CWE-122 kernel: Memory corruption due to incorrect socket cloning
kernel: Memory corruption due to incorrect socket cloning
In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel.
A possible memory corruption due to a type confusion was found in the Linux kernel in the sk_clone_lock() function in the net/core/sock.c. The possibility of local escalation of privileges cannot be fully ruled out for a local unprivileged attacker.
Mitigation: The currently known attack vector uses IPv6 for exploitation. If IPv6 is not needed on the host, disabling it mitigates this attack vector. Plea
No detection rules found.
No public exploits indexed.
arXiv
Virtual Reality, Real Problems: A Longitudinal Security Analysis of VR Firmware
arxiv_fulltext·2025-09-07
Virtual Reality, Real Problems: A Longitudinal Security Analysis of VR Firmware
## Abstract
Virtual Reality (VR) technology is rapidly growing in recent years.
VR devices such as Meta Quest 3 utilize numerous sensors to collect users' data to provide an immersive experience.
Due to the extensive data collection and the immersive nature,
the security of VR devices is paramount.
Leading VR devices often adopt and customize Android systems,
which makes them susceptible to both Android-based vulnerabilities and new issues introduced by VR-specific customizations (e.g., system services to support continuous head and hand tracking).
While prior work has extensively examined the security properties of the Android software stack, how these security properties hold for VR systems remains unexplored.
In this paper, we present the first comprehensive security analysis of VR fi
arXiv
In-Kernel Control-Flow Integrity on Commodity OSes using ARM Pointer Authentication
arxiv_fulltext·2021-12-14
In-Kernel Control-Flow Integrity on Commodity OSes using ARM Pointer Authentication
-30pt In-Kernel Control-Flow Integrity on Commodity OSes
using ARM Pointer Authentication
fancyplain
Rev.
\ of LastPage
Sungbae Yoo^ ^ \;
Jinbum Park^ ^ \;
Seolheui Kim^ \;
Yeji Kim^ \;
Taesoo Kim^ ^ \;
^ Samsung Research,
^ Georgia Institute of Technology
## Abstract
This paper presents
an in-kernel, hardware-based control-flow integrity (CFI) protection,
called ,
that utilizes ARM's Pointer Authentication (PA).
It provides three important benefits
over commercial, state-of-the-art PA-based CFIs
like iOS's:
1) enhancing CFI precision via
automated refinement techniques,
2) addressing hindsight problems of PA for in-kernel uses
such as preemptive hijacking and brute-forcing attacks,
and 3) assuring the algorithmic or implementation correctness
via post validation.
achieves these
Bugzilla
CVE-2018-9568 kernel: Memory corruption due to incorrect socket cloning
bugzilla·2018-12-04·CVSS 7.8
CVE-2018-9568 [HIGH] CVE-2018-9568 kernel: Memory corruption due to incorrect socket cloning
CVE-2018-9568 kernel: Memory corruption due to incorrect socket cloning
A possible memory corruption due to a type confusion was found in the Linux kernel in the sk_clone_lock() function in the net/core/sock.c. A possibility of local escalation of privileges cannot be fully ruled out for a local unprivileged attacker.
References:
https://source.android.com/security/bulletin/2018-12-01.html#kernel-components
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d538fa60bad4f7b23193c89e843797a1cf71ef3
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2019:0514 https://access.redhat.com/errata/RHSA-2019:0514
---
This issue has been addressed in the following products:
Red Hat Enterpr
https://access.redhat.com/errata/RHSA-2019:0512https://access.redhat.com/errata/RHSA-2019:0514https://access.redhat.com/errata/RHSA-2019:2696https://access.redhat.com/errata/RHSA-2019:2730https://access.redhat.com/errata/RHSA-2019:2736https://access.redhat.com/errata/RHSA-2019:3967https://access.redhat.com/errata/RHSA-2019:4056https://access.redhat.com/errata/RHSA-2019:4159https://access.redhat.com/errata/RHSA-2019:4164https://access.redhat.com/errata/RHSA-2019:4255https://source.android.com/security/bulletin/2018-12-01https://usn.ubuntu.com/3880-1/https://usn.ubuntu.com/3880-2/https://access.redhat.com/errata/RHSA-2019:0512https://access.redhat.com/errata/RHSA-2019:0514https://access.redhat.com/errata/RHSA-2019:2696https://access.redhat.com/errata/RHSA-2019:2730https://access.redhat.com/errata/RHSA-2019:2736https://access.redhat.com/errata/RHSA-2019:3967https://access.redhat.com/errata/RHSA-2019:4056https://access.redhat.com/errata/RHSA-2019:4159https://access.redhat.com/errata/RHSA-2019:4164https://access.redhat.com/errata/RHSA-2019:4255https://source.android.com/security/bulletin/2018-12-01https://usn.ubuntu.com/3880-1/https://usn.ubuntu.com/3880-2/
2018-12-06
Published