CVE-2018-10876: Use After Free

Published Jun 29, 2018
·
Updated

A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4extremovespace() function when mounting and operating a crafted ext4 image.

Affected Software

42 affected componentsFixes available
Linux Linux kernel
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Debian Debian Linux=8.0
debian/linux
6.1.176-16.1.190-16.12.107-16.12.113-17.2.11-17.2.12-1
Google Android
ubuntu/linux-aws<4.4.0-1028.31
4.4.0-1028.31
ubuntu/linux-azure<4.15.0-1037.39~14.04.2
4.15.0-1037.39~14.04.2
ubuntu/linux-lts-xenial<4.4.0-134.160~14.04.1
4.4.0-134.160~14.04.1
ubuntu/linux*
ubuntu/linux<4.4.0-134.160
4.4.0-134.160
ubuntu/linux-aws<4.4.0-1066.76
4.4.0-1066.76
ubuntu/linux-aws-hwe<4.15.0-1032.34~16.04.1
4.15.0-1032.34~16.04.1
ubuntu/linux-azure<4.15.0-1037.39~16.04.1
4.15.0-1037.39~16.04.1
ubuntu/linux-gcp<4.15.0-1027.28~16.04.1
4.15.0-1027.28~16.04.1
ubuntu/linux-hwe<4.15.0-45.48~16.04.1
4.15.0-45.48~16.04.1
ubuntu/linux-kvm<4.4.0-1032.38
4.4.0-1032.38
ubuntu/linux-raspi2<4.4.0-1095.103
4.4.0-1095.103
ubuntu/linux-snapdragon<4.4.0-1099.104
4.4.0-1099.104
ubuntu/linux-fips<4.4.0-1008.10
4.4.0-1008.10
ubuntu/linux<4.15.0-44.47
4.15.0-44.47
ubuntu/linux-aws<4.15.0-1032.34
4.15.0-1032.34
ubuntu/linux-azure<4.15.0-1037.39
4.15.0-1037.39
ubuntu/linux-gcp<4.15.0-1027.28
4.15.0-1027.28
ubuntu/linux-kvm<4.15.0-1029.29
4.15.0-1029.29
ubuntu/linux-oem<4.15.0-1033.38
4.15.0-1033.38
ubuntu/linux-raspi2<4.15.0-1031.33
4.15.0-1031.33
ubuntu/linux-snapdragon<4.15.0-1053.57
4.15.0-1053.57
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-5.15*
ubuntu/linux-gke*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-azure-6.11*
ubuntu/linux-gcp-6.11*
ubuntu/linux-hwe-6.11*
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.11-1Fixed in 7.2.12-1
  2. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1028.31
  3. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1037.39~14.04.2
  4. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-134.160~14.04.1
  5. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-134.160
  6. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1066.76
  7. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1032.34~16.04.1
  8. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1037.39~16.04.1
  9. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1027.28~16.04.1
  10. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-45.48~16.04.1
  11. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1032.38
  12. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.4.0-1095.103
  13. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.4.0-1099.104
  14. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1008.10
  15. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-44.47
  16. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1032.34
  17. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1037.39
  18. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1027.28
  19. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1029.29
  20. Upgrade

    Upgrade ubuntu/linux-oem to a version that resolves this vulnerability.

    Fixed in 4.15.0-1033.38
  21. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1031.33
  22. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.15.0-1053.57
  23. Upgrade

    Upgrade Linux kernel ext4 filesystem to a version that resolves this vulnerability.

    Patch 8844618d8aa7a9973e7b527d038a2a589665002c

Event History

Jun 29, 2018
Data Sourced
via Red Hat·05:14 PM
DescriptionSeverityAffected Software
Jul 26, 2018
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 7, 2019
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2018-10876?

CVE-2018-10876 has a high severity rating due to its potential to allow for exploitation through a use-after-free vulnerability in the ext4 filesystem.

2

How do I fix CVE-2018-10876?

To fix CVE-2018-10876, update the Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1.

3

Which systems are affected by CVE-2018-10876?

Affected systems include certain versions of Debian GNU/Linux, Ubuntu Linux, and Google Android that utilize the ext4 filesystem.

4

What impact does CVE-2018-10876 have on systems?

CVE-2018-10876 can lead to system crashes and potentially allow unauthorized access or code execution through crafted ext4 images.

5

Is there a permanent fix for CVE-2018-10876?

Yes, the permanent fix involves ensuring that your system is upgraded to the recommended kernel versions that address the vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203