CVE Vulnerability

CVE-2018-5814

In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets.

6.9 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.4 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

7 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://secuniaresearch.flexerasoftware.com/secunia_research/2018-8/ Third Party Advisory
https://secuniaresearch.flexerasoftware.com/advisories/81540/ Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=c171654caa875919be3c533d3518da8be5be966e Patch Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=22076557b07c12086eeb16b8ce2b0b735f7a27e7 Patch Vendor Advisory
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.102 Vendor Advisory
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.133 Vendor Advisory
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.11 Vendor Advisory
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.43 Vendor Advisory
http://www.securitytracker.com/id/1041050 Third Party Advisory VDB Entry
https://usn.ubuntu.com/3696-2/ Third Party Advisory
https://usn.ubuntu.com/3696-1/ Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html Third Party Advisory
https://usn.ubuntu.com/3752-2/ Third Party Advisory
https://usn.ubuntu.com/3752-1/ Third Party Advisory
https://usn.ubuntu.com/3752-3/ Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html
Configurations

Configuration 1

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Information

Published : 2018-06-12 04:29

Updated : 2019-05-20 03:29

NVD link : CVE-2018-5814

Mitre link : CVE-2018-5814

Products Affected
No products.
CWE
CWE-362