CVE-2018-5332: High severity Linux Linux kernel vulnerability
In the Linux kernel through 3.2, the rdsmessageallocsgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rdsrdmaextrasize function in net/rds/rdma.c).
Other sources
In the Linux kernel through 4.14.13, the rdsmessageallocsgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rdsrdmaextrasize() function in 'net/rds/rdma.c') and thus to a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
References:
https://marc.info/?t=151492231500011&r=1&w=2
https://patchwork.ozlabs.org/patch/854723/
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c095508770aebf1b9218e77026e48345d719b17c
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5332?
CVE-2018-5332 has a medium severity rating due to the potential for heap-based out-of-bounds writes.
How do I fix CVE-2018-5332?
To fix CVE-2018-5332, update your Linux kernel to the latest patched version such as 5.10.223-1 or 6.1.123-1.
What systems are affected by CVE-2018-5332?
CVE-2018-5332 affects various versions of the Linux kernel including versions 3.2 through 4.14.13.
What type of vulnerability is CVE-2018-5332?
CVE-2018-5332 is a heap-based out-of-bounds write vulnerability related to insufficient validation in the rds_message_alloc_sgs function.
Is CVE-2018-5332 related to any specific Linux distributions?
CVE-2018-5332 is relevant to multiple Linux distributions, including Debian and Ubuntu, impacting various kernel versions.