CVE-2018-13053: Integer Overflow
A flaw was found in the alarmtimernsleep() function in kernel/time/alarmtimer.c in the Linux kernel. The ktimeaddsafe() function is not used and an integer overflow can happen causing an alarm not to fire or possibly a denial-of-service if using a large relative timeout.
References:
https://bugzilla.kernel.org/showbug.cgi?id=200303
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f936e19cc0ef97dbe3a56e9498922ad5ba1edef
Other sources
The alarmtimernsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktimeaddsafe is not used.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.94-1Fixed in 6.12.107-1Fixed in 7.1.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-13053?
CVE-2018-13053 has a high severity due to its potential to cause denial-of-service from integer overflow.
How do I fix CVE-2018-13053?
To fix CVE-2018-13053, update the Linux kernel to a version that includes the necessary patches, such as 5.10.223-1 or newer.
What versions of Linux are affected by CVE-2018-13053?
CVE-2018-13053 affects Linux kernel versions up to and including 4.17.3 and specific Ubuntu and Debian releases.
Can CVE-2018-13053 lead to remote code execution?
CVE-2018-13053 does not lead to remote code execution directly but can cause denial-of-service conditions.
What component of the Linux kernel does CVE-2018-13053 affect?
CVE-2018-13053 affects the alarm_timer_nsleep() function in the Linux kernel's alarm timer implementation.