CVE-2018-17182: Use After Free
A security flaw was discovered in the Linux kernel. The vmacacheflushall() function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.
References:
https://seclists.org/oss-sec/2018/q3/251
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7a9cdebdcc17e426fb5287e4a82db1dfe86339b2
Other sources
An issue was discovered in the Linux kernel through 4.18.8. The vmacacheflushall function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.107-1Fixed in 7.1.12-1Fixed in 7.1.13-1
Event History
Frequently Asked Questions
What is CVE-2018-17182?
CVE-2018-17182 is a vulnerability discovered in the Linux kernel through version 4.18.8 that allows an attacker to trigger a use-after-free and possibly gain privileges.
How severe is CVE-2018-17182?
CVE-2018-17182 has a severity level of 7, which is considered high.
Which software versions are affected by CVE-2018-17182?
CVE-2018-17182 affects Linux kernel versions up to and including version 4.18.8.
How can I fix CVE-2018-17182?
To fix CVE-2018-17182, update your Linux kernel to version 4.19 or later.
Where can I find more information about CVE-2018-17182?
You can find more information about CVE-2018-17182 at the following links: [Link 1](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7a9cdebdcc17e426fb5287e4a82db1dfe86339b2), [Link 2](https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2), [Link 3](https://www.openwall.com/lists/oss-security/2018/09/18/4).