CVE-2018-16948: Infoleak
First published: Wed Sep 12 2018(Updated: )
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm | <1.6.23 | |
| npm | >=1.8.0<1.8.2 | |
| Debian | =8.0 | |
| Debian | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-16948?
CVE-2018-16948 has a medium severity level due to its potential to leak sensitive memory information.
How do I fix CVE-2018-16948?
To fix CVE-2018-16948, update OpenAFS to version 1.6.23 or 1.8.2 and later releases.
What systems are affected by CVE-2018-16948?
CVE-2018-16948 affects OpenAFS versions prior to 1.6.23 and versions within the 1.8.x series before 1.8.2, as well as Debian Linux 8.0 and 9.0.
What type of vulnerability is CVE-2018-16948?
CVE-2018-16948 is a memory leak vulnerability caused by insufficient initialization of output variables in several RPC server routines.
Can CVE-2018-16948 be exploited remotely?
Yes, CVE-2018-16948 can potentially be exploited remotely through the OpenAFS cache manager's RPC communications.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/openafs
- canonical/npm
- version/npm/1.8.0
- vendor/debian
- canonical/debian
- version/debian/8.0
- version/debian/9.0