CVE-2018-11412: Use After Free
In the Linux kernel 4.13 through 4.16.11, ext4readinlinedata() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode.
Other sources
The fs/ext4/inline.c:ext4readinlinedata() function in the Linux kernel performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode. The unbound copy can cause memory corruption or possible privilege escalation.
An upstream bug:
https://bugzilla.kernel.org/showbug.cgi?id=199803
Upstream patches:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=117166efb1ee8f13c38f9e96b258f16d4923f888
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eb9b5f01c33adebc31cbc236c02695f605b0e417
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-11412.
What is the title of this vulnerability?
The title of this vulnerability is 'In the Linux kernel 4.13 through 4.16.11 ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode.'
What is the severity level of CVE-2018-11412?
The severity level of CVE-2018-11412 is medium.
What software is affected by this vulnerability?
The Linux kernel versions 4.13 through 4.16.11 are affected by this vulnerability.
Are there any references to more information about CVE-2018-11412?
Yes, you can find more information about CVE-2018-11412 at the following references: [1](https://bugs.chromium.org/p/project-zero/issues/detail?id=1580), [2](https://bugzilla.kernel.org/show_bug.cgi?id=199803), [3](http://www.securityfocus.com/bid/104291).