CVE Vulnerability

CVE-2018-17972

An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents.

4.9 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

Scope

5.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://marc.info/?l=linux-fsdevel&m=153806242024956&w=2 Patch Third Party Advisory
http://www.securityfocus.com/bid/105525 Third Party Advisory VDB Entry
https://usn.ubuntu.com/3821-2/ Third Party Advisory
https://usn.ubuntu.com/3821-1/ Third Party Advisory
https://usn.ubuntu.com/3832-1/ Third Party Advisory
https://usn.ubuntu.com/3835-1/ Third Party Advisory
https://usn.ubuntu.com/3871-1/ Third Party Advisory
https://usn.ubuntu.com/3880-2/ Third Party Advisory
https://usn.ubuntu.com/3871-4/ Third Party Advisory
https://usn.ubuntu.com/3871-3/ Third Party Advisory
https://usn.ubuntu.com/3880-1/ Third Party Advisory
https://usn.ubuntu.com/3871-5/ Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0514 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0512 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html
https://access.redhat.com/errata/RHSA-2019:0831
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html
https://access.redhat.com/errata/RHSA-2019:2473
https://support.f5.com/csp/article/K27673650?utm_source=f5support&utm_medium=RSS
Configurations

Configuration 1

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Information

Published : 2018-10-03 10:29

Updated : 2020-10-15 01:28

NVD link : CVE-2018-17972

Mitre link : CVE-2018-17972

Products Affected
No products.
CWE
CWE-362