CVE-2018-18559: Race Condition
A use-after-free flaw can occur in the Linux kernel due to a race condition between packetdobind() and packetnotifier() functions called for an AFPACKET socket. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to an unresponsive system or to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.
External Reference:
https://blogs.securiteam.com/index.php/archives/3731
A probable fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=15fe076edea787807a7cdc168df832544b58eba6
Other sources
In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanoutadd from setsockopt and bind on an AFPACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packetdobind unregister action followed by a packetnotifier register action. Later, packetrelease operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-18559?
CVE-2018-18559 is a vulnerability in the Linux kernel that can lead to a use-after-free due to a race condition.
What is the severity of CVE-2018-18559?
The severity of CVE-2018-18559 is high with a CVSS score of 8.1.
How does CVE-2018-18559 affect Linux?
CVE-2018-18559 affects various versions of the Linux kernel.
What is the fix for CVE-2018-18559?
The fix for CVE-2018-18559 can be found in the Linux kernel's commit 15fe076edea787807a7cdc168df832544b58eba6.
Are there any references available for CVE-2018-18559?
Yes, you can find references for CVE-2018-18559 in the SecuriTeam blog, the Linux kernel's commit, and the Red Hat bugzilla.