CVE-2018-18397: Medium severity Linux Linux kernel vulnerability
A flaw was found in the Linux kernel with files on tmpfs and hugetlbfs. An attacker is able to bypass file permissions on filesystems mounted with tmpfs/hugetlbs to modify a file and possibly disrupt normal system behaviour.
At this time there is an understanding there is no crash or priviledge escalation but the impact of modifications on these filesystems of files in production systems may have adverse affects.
A suggested upstream patch:
https://lore.kernel.org/lkml/20181126173452.26955-1-aarcange@redhat.com/T/#u
An upstream patchset:
9e368259ad988356c4c95150fafd1a06af095d98 userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails 5b51072e97d587186c2f5390c8c9c1fb7e179505 userfaultfd: shmem: allocate anonymous memory for MAPPRIVATE shmem 29ec90660d68bbdd69507c1c8b4e33aa299278b1 userfaultfd: shmem/hugetlbfs: only allow to register VMMAYWRITE vmas e2a50c1f64145a04959df2442305d57307e5395a userfaultfd: shmem: add isize checks dcf7fe9d89763a28e0f43975b422ff141fe79e43 userfaultfd: shmem: UFFDIOCOPY: set the page dirty if VMWRITE is not set
Other sources
The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 4.19.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch dcf7fe9d89763a28e0f43975b422ff141fe79e43 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch e2a50c1f64145a04959df2442305d57307e5395a - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 29ec90660d68bbdd69507c1c8b4e33aa299278b1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 5b51072e97d587186c2f5390c8c9c1fb7e179505 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 9e368259ad988356c4c95150fafd1a06af095d98
Event History
Frequently Asked Questions
What is the severity of CVE-2018-18397?
CVE-2018-18397 is considered a medium severity vulnerability that allows permission bypass on specific filesystems.
How do I fix CVE-2018-18397?
To mitigate CVE-2018-18397, upgrade your Linux kernel to one of the patched versions, such as 5.10.223-1 or 6.1.123-1.
What systems are affected by CVE-2018-18397?
CVE-2018-18397 affects various Linux distributions including Debian, Red Hat Enterprise Linux, and Ubuntu across specific versions.
Is there any immediate risk associated with CVE-2018-18397?
While CVE-2018-18397 does not cause system crashes, it can be exploited to modify files and disrupt normal system behavior.
How can I check if my system is vulnerable to CVE-2018-18397?
You can check if your system is vulnerable to CVE-2018-18397 by verifying the kernel version against the list of affected versions and checking for updates.