medium
6.3
Advisory Published
CVE Published
Updated

CVE-2018-1000204

First published: Fri Jun 08 2018(Updated: )

** DISPUTED ** Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually impossible to exploit."

Credit: cve@mitre.org cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Linux Linux kernel>=3.18<=4.16
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Debian Debian Linux=8.0
debian/linux
5.10.223-1
5.10.226-1
6.1.115-1
6.1.119-1
6.11.10-1
6.12.5-1

Remedy

https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2018-1000204?

    The severity of CVE-2018-1000204 is low.

  • How does CVE-2018-1000204 affect Linux Kernel?

    CVE-2018-1000204 affects Linux Kernel versions 3.18 to 4.16.

  • What is the vulnerability in CVE-2018-1000204?

    The vulnerability in CVE-2018-1000204 is an incorrect handling of an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp, which may lead to copying up to 1000 kernel heap pages to the userspace.

  • Has the vulnerability in CVE-2018-1000204 been fixed?

    Yes, the vulnerability has been fixed upstream in the Linux Kernel.

  • Where can I find more information about CVE-2018-1000204?

    You can find more information about CVE-2018-1000204 at the following references: [1] [2] [3].

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203