CVE-2018-10883: Medium severity Google Android vulnerability
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in jbd2journaldirtymetadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.
References:
https://bugzilla.kernel.org/showbug.cgi?id=200071
Upstream patches:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8bc1379b82b8e809eef77a9fedbb75c6c297be19
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e09463f220ca9a1a1ecfda84fcda658f99a1f12a
Other sources
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2journaldirtymetadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10883?
CVE-2018-10883 is rated as a high severity vulnerability due to its potential to cause denial of service and system crashes.
How do I fix CVE-2018-10883?
To fix CVE-2018-10883, update to a kernel version that includes the fix, such as 5.10.223-1 or any later versions.
Who is affected by CVE-2018-10883?
CVE-2018-10883 affects various systems including Debian Linux 8.0, several versions of Ubuntu Linux (14.04, 16.04, 18.04), and Red Hat Enterprise Linux 7.0.
What type of attack can CVE-2018-10883 cause?
CVE-2018-10883 can allow a local user to conduct an out-of-bounds write attack resulting in a denial of service.
Is CVE-2018-10883 specific to any Linux kernels?
CVE-2018-10883 impacts the Linux kernel up to version 4.9.110, making upgrades essential for security.