CVE-2018-10882: Medium severity Linux Linux kernel vulnerability
A flaw was found in the Linux kernel's ext4 file system. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, which can lead to memory corruption. This can mean that the memory can be corrupted to create a denial of service, and a system crash or privilege escalation by unmounting a crafted ext4 filesystem image.
References:
https://bugzilla.kernel.org/showbug.cgi?id=200069
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c37e9e013469521d9adb932d17a1795c139b36db
Other sources
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10882?
CVE-2018-10882 is considered a medium to high severity vulnerability due to the potential for memory corruption and system crashes.
How do I fix CVE-2018-10882?
To fix CVE-2018-10882, users should update their Linux kernel to the latest patched version as recommended by their distribution.
Who is affected by CVE-2018-10882?
CVE-2018-10882 affects local users on systems using vulnerable versions of the Linux kernel, particularly in ext4 file systems.
What are the potential consequences of CVE-2018-10882?
Exploitation of CVE-2018-10882 could lead to denial of service, system crashes, or privilege escalation.
Is CVE-2018-10882 a remote exploit?
No, CVE-2018-10882 requires local access to the system for exploitation.