CVE-2018-20784: Critical severity Linux Linux kernel vulnerability
In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfsrq's, which allows attackers to cause a denial of service (infinite loop in updateblockedaverages) or possibly have unspecified other impact by inducing a high load.
Other sources
The CFS Linux kernel scheduler mishandles handling of leaf cfsrq's in the kernel/sched/fair.c code, which allows a local unprivileged attacker to cause a denial of service (DoS) by entering an infinite loop in updateblockedaverages() function by inducing a high load on a system. Due to the nature of the flaw, a remote network attack (by initiating a magnitude of remote requests) cannot be fully ruled out.
The CFS Linux kernel scheduler mishandles handling of leaf cfsrq's in the kernel/sched/fair.c code, which allows a local unprivileged attacker to cause a denial of service (DoS) by entiring the infinite loop in updateblockedaverages() function by inducing a high load on a system. Due to the nature of the flaw, a remote network attack (by initiating a magnitude of remote requests) cannot be fully ruled out, although we believe it is unlikely.
References:
https://lore.kernel.org/lkml/1545879866-27809-1-git-send-email-xiexiuqi@huawei.com/T/#u
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c40f7d74c741a907cfaeb73a7697081881c497d0
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-80.7.1.rt9.153.el8_0 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-80.7.1.el8_0 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.20.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-20784?
CVE-2018-20784 has a severity rating that can lead to denial of service due to infinite loops in certain Linux kernel scheduling mechanisms.
How do I fix CVE-2018-20784?
To fix CVE-2018-20784, update your Linux kernel to versions 4.20.2 or newer, or apply the appropriate patches as specified by your distribution.
Which Linux distributions are affected by CVE-2018-20784?
CVE-2018-20784 affects multiple Linux distributions including Red Hat Enterprise Linux, Ubuntu, and various versions of the Linux kernel.
Can CVE-2018-20784 be exploited remotely?
CVE-2018-20784 is exploitable locally, allowing attackers to induce high loads leading to a denial of service on the affected systems.
What versions of the Linux kernel are vulnerable to CVE-2018-20784?
Linux kernel versions prior to 4.20.2, specifically those between 4.13 and 4.19, as well as certain earlier kernel versions, are vulnerable to CVE-2018-20784.