CVE-2018-1065: Null Pointer Dereference
The Linux kernel at version 4.15.0-rc9 is vulnerable to a NULL pointer dereference ip6tables.c:ip6tdotable() leading to a crash. This vulnerability is only present under certain malformed iptables rulesets.
Inserting malformed rules its a privileged operation as root or a user with CAPNETRAW,CAPNETADMIN capabilities ( see man setcap(8) ).
As this requires advanced privileges Red Hat Product Security has rated this flaw as moderate.
Additional References:
Netdev list: http://lists.openwall.net/netdev/2018/01/27/46
A suggested upstream patch: http://patchwork.ozlabs.org/patch/870355/
An upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7
Other sources
The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAPNETRAW or CAPNETADMIN capability, related to arptdotable in net/ipv4/netfilter/arptables.c, iptdotable in net/ipv4/netfilter/iptables.c, and ip6tdotable in net/ipv6/netfilter/ip6tables.c.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1
Event History
Frequently Asked Questions
What is CVE-2018-1065?
CVE-2018-1065 is a vulnerability in the Linux kernel netfilter subsystem that can cause a denial of service.
How severe is CVE-2018-1065?
CVE-2018-1065 has a severity level of medium.
How does CVE-2018-1065 affect Linux?
CVE-2018-1065 affects the Linux kernel through version 4.15.7.
How can the CVE-2018-1065 vulnerability be fixed?
To fix CVE-2018-1065, update the Linux kernel to version 4.16 or above.
Where can I find more information about CVE-2018-1065?
You can find more information about CVE-2018-1065 at the following references: [Link 1](http://lists.openwall.net/netdev/2018/01/27/46), [Link 2](http://patchwork.ozlabs.org/patch/870355/), [Link 3](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7)