CVE-2018-1000199: Buffer Overflow
An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIGHAVEHWBREAKPOINT) support. While modifying a h/w breakpoint via 'modifyuserhwbreakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.
Other sources
Linux kernel built with the hardware breakpoint(CONFIGHAVEHWBREAKPOINT) support is vulnerable to a breakpoint address corruption issue. It could occur while modifying a h/w breakpoint via 'modifyuserhwbreakpoint' routine.
An unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.
Upstream patches: ----------------- -> https://git.kernel.org/linus/f67b15037a7a50c57f72e69a6d59941ad90a0f0f -> https://git.kernel.org/linus/18ff57b220610a699947f20b156a8245ca7eee98 -> https://git.kernel.org/linus/705feaf321c37e4dca3637fd5cb3b275f17a06c9
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2018/05/01/3
— Red Hat
The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modifyuserhwbreakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-862.2.3.rt56.806.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-862.2.3.el7 - Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-49.2.2.el7a - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-327.66.3.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-514.48.3.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-693.25.4.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 1:3.10.0-693.25.4.rt56.613.el6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.257-1Fixed in 6.1.170-3Fixed in 6.1.174-1Fixed in 6.12.86-1Fixed in 6.12.94-1Fixed in 7.0.13-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch f67b15037a7a50c57f72e69a6d59941ad90a0f0f - Compensating control
Install systemtap and dependencies (`yum install -y systemtap systemtap-runtime kernel-devel kernel-debuginfo kernel-debuginfo-common`) to build/load the provided mitigation SystemTap script for CVE-2018-1000199.
- Operational
Save the mitigation script content as a file named `CVE-2018-1000199.stp`, then build the mitigation module as root and load it as root (as described: `stap -r `uname -r` -m cve_2018_1000199.ko -g CVE-2018-1000199.stp -p4` and `staprun -L cve_2018_1000199.ko`).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-1000199?
CVE-2018-1000199 is classified as a critical vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2018-1000199?
To address CVE-2018-1000199, update to the specified remedial kernel versions provided by your Linux distribution.
What systems are affected by CVE-2018-1000199?
CVE-2018-1000199 affects various versions of the Linux kernel, particularly those built with hardware breakpoint support.
Can CVE-2018-1000199 be exploited by unprivileged users?
Yes, CVE-2018-1000199 can be exploited by unprivileged users to crash the system kernel.
What types of denial of service are caused by CVE-2018-1000199?
CVE-2018-1000199 can lead to system crashes, resulting in a denial of service for affected systems.