CVE-2018-14617: Null Pointer Dereference
An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfspluslookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14617?
CVE-2018-14617 has a moderate severity rating due to the potential for a NULL pointer dereference leading to a kernel panic.
How do I fix CVE-2018-14617?
To fix CVE-2018-14617, update the Linux kernel to version 5.10.223-1 or later.
Which versions of Linux are affected by CVE-2018-14617?
CVE-2018-14617 affects Linux kernel versions up to and including 4.17.10 and several versions of Debian and Ubuntu Linux.
What happens if CVE-2018-14617 is exploited?
If exploited, CVE-2018-14617 may result in a kernel panic, causing the system to become unresponsive.
Is CVE-2018-14617 specific to any filesystem?
Yes, CVE-2018-14617 is specific to the hfs+ filesystem when dealing with malformed catalog data.