CVE-2018-1000004: Race Condition
In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition.
Other sources
In the Linux kernel versions 4.12, 3.10, 2.6 and possibly earlier, a race condition vulnerability exists in the sound system allowing for a potential deadlock and memory corruption due to use-after-free condition and thus denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
References:
http://seclists.org/oss-sec/2018/q1/51
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b3defb791b26ea0683a93a4f49c77ec45ec96f10
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch b3defb791b26ea0683a93a4f49c77ec45ec96f10
Event History
Frequently Asked Questions
What is CVE-2018-1000004 vulnerability?
CVE-2018-1000004 is a race condition vulnerability in the Linux kernel sound system that can lead to a deadlock and denial of service.
Which versions of the Linux kernel are affected by CVE-2018-1000004?
Linux kernel versions 4.12, 3.10, 2.6, and possibly earlier versions are affected by CVE-2018-1000004.
What is the severity of CVE-2018-1000004?
CVE-2018-1000004 has a severity level of medium.
How can I fix CVE-2018-1000004 vulnerability?
To fix CVE-2018-1000004, update to Linux kernel version 4.15 or higher.
Where can I find more information about CVE-2018-1000004 vulnerability?
You can find more information about CVE-2018-1000004 at the following references: [1] [2] [3].