CVE-2018-12232: Race Condition
A NULL pointer dereference issue was found in the Linux kernel. If the close() and fchownat() system calls share a socket file descriptor as an argument, then the two calls can race and trigger a NULL pointer dereference leading to a system crash and a denial of service.
References:
https://lkml.org/lkml/2018/6/5/14
https://marc.info/?t=152817459500001&r=1&w=2
https://patchwork.ozlabs.org/patch/926519/
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d8c50dcb029872b298eea68cc6209c866fd3e14
Other sources
In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sockclose and sockfssetattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12232?
CVE-2018-12232 has a severity value of medium.
How does CVE-2018-12232 affect the Linux kernel?
CVE-2018-12232 is a race condition vulnerability in the Linux kernel.
Which Linux kernel versions are affected by CVE-2018-12232?
Linux kernel versions up to 4.17.1 are affected by CVE-2018-12232.
What is the recommended remedy for CVE-2018-12232?
For Ubuntu, updating to version 4.18~ or later of the Linux kernel is recommended.
Where can I find more information about CVE-2018-12232?
More information about CVE-2018-12232 can be found in the provided references.