CVE-2018-16871: Null Pointer Dereference
A flaw was found in NFS in the Linux Kernel. An attacker who is able to mount an exported NFS filesystem is able to trigger a null pointer dereference by an invalid NFS sequence.
This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.
Upstream fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01310bb7c9c98752cc763b36532fab028e0f8f81
Other sources
A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.
A flaw was found in the Linux kernel's NFS implementation. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2018-16871?
CVE-2018-16871 is a vulnerability in the Linux kernel's NFS implementation that allows an attacker to trigger a null pointer dereference, potentially causing the system to panic and deny access.
How does CVE-2018-16871 affect the Linux kernel?
CVE-2018-16871 affects all versions 3.x and all versions 4.x up to 4.20 of the Linux kernel.
What is the severity of CVE-2018-16871?
CVE-2018-16871 has a severity rating of high and a score of 7.
Which software versions are affected by CVE-2018-16871?
The affected software versions are: kernel-rt 3.10.0-957.27.2.rt56.940.el7, kernel 3.10.0-957.27.2.el7, kernel-alt 4.14.0-115.18.1.el7a, kernel 3.10.0-693.58.1.el7, kernel-rt 4.18.0-193.rt13.51.el8, kernel 4.18.0-193.el8, and kernel-rt 3.10.0-693.58.1.rt56.652.el6.
How can CVE-2018-16871 be fixed?
To fix CVE-2018-16871, it is recommended to update the Linux kernel to a version that includes the necessary patches.