CVE-2018-14646: Null Pointer Dereference
The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the netlinknscapable() function in the net/netlink/afnetlink.c file. A local attacker could exploit this when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service.
Other sources
The Linux kernel was found to be vulnerable to a NULL pointer dereference bug in the netlinknscapable() function in the net/netlink/afnetlink.c file. A local attacker could exploit this when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service.
References:
https://marc.info/?l=linux-netdev&m=151500466401174&w=2
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f428fe4a04cc339166c8bbd489789760de3a0cee
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14646?
CVE-2018-14646 has been classified as a high severity vulnerability due to its potential to cause a kernel panic and denial of service.
How do I fix CVE-2018-14646?
To remediate CVE-2018-14646, you should upgrade your Linux kernel to version 4.15 or later.
Who is affected by CVE-2018-14646?
CVE-2018-14646 affects local users running vulnerable versions of the Linux kernel prior to 4.15-rc8.
Is CVE-2018-14646 exploitable remotely?
No, CVE-2018-14646 can only be exploited locally by an attacker who has access to the system.
What systems are impacted by CVE-2018-14646?
Systems running Linux kernel versions before 4.15-rc8, including various Red Hat enterprise products, are impacted by CVE-2018-14646.