CVE-2018-1108: Medium severity Linux Linux kernel vulnerability
kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 4.17-rc1
Event History
Frequently Asked Questions
What is the vulnerability ID of this weakness?
The vulnerability ID of this weakness is CVE-2018-1108.
What is the description of this vulnerability?
This vulnerability occurs in kernel drivers before version 4.17-rc1 and is related to the Linux kernel's implementation of random seed data.
Which software versions are affected by this vulnerability?
The vulnerability affects various versions of the Linux kernel, including Ubuntu packages linux, linux-goldfish, linux-grouper, linux-flo, linux-aws, linux-gke, linux-azure, linux-gcp, linux-euclid, linux-azure-edge, linux-hwe, linux-lts-trusty, linux-lts-utopic, linux-lts-vivid, linux-hwe-edge, linux-kvm, linux-lts-wily, linux-lts-xenial, linux-maguro, linux-mako, linux-manta, linux-oem, linux-raspi2, and linux-snapdragon.
How can I fix this vulnerability?
To fix this vulnerability, update your Linux kernel to version 4.17 or higher.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability in the references section of the advisory.