CVE-2018-5344: Race Condition
A flaw was found in the Linux kernels handling of loopback devices where it mishandles the release (lorelease function) where an attacker who has permissions to setup loopback disks.
This may allow an attacker to cause a denial of service (lockacquire use-after-free) or possibly have unspecified other impact.
Upstream patch:
https://github.com/torvalds/linux/commit/ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5
Other sources
In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lorelease serialization, which allows attackers to cause a denial of service (lockacquire use-after-free) or possibly have unspecified other impact.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 4.14.13Patch ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2018-5344.
What is the severity of CVE-2018-5344?
The severity of CVE-2018-5344 is medium.
How does the vulnerability in the Linux kernel through 4.14.13 impact systems?
The vulnerability allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact.
Which software versions are affected by CVE-2018-5344?
The vulnerability affects Linux kernel versions through 4.14.13.
Are there any remediation steps available?
Yes, updating to Linux kernel version 4.15~ or higher is recommended to fix this vulnerability.