CVE-2018-7492: Null Pointer Dereference
A NULL pointer dereference was found in net/rds/rdma.c:rdsrdmamap() function in the Linux kernel allowing local attackers to cause a system panic and a denial-of-service.
References:
https://patchwork.kernel.org/patch/10096441/
https://xorl.wordpress.com/2017/12/18/linux-kernel-rdma-null-pointer-dereference/
http://seclists.org/oss-sec/2018/q1/191
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f3069c6d33f6ae63a1668737bc78aaaa51bff7ca
Other sources
A NULL pointer dereference was found in the net/rds/rdma.c rdsrdmamap() function in the Linux kernel before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to RDSGETMR and RDSGETMRFORDEST.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7492?
CVE-2018-7492 has a high severity rating due to its potential to cause a denial-of-service through a system crash.
How do I fix CVE-2018-7492?
To fix CVE-2018-7492, update to a kernel version that is not affected, specifically versions later than 4.14.7.
Which systems are affected by CVE-2018-7492?
CVE-2018-7492 affects Linux kernel versions up to 4.14.7 and specific Debian and Ubuntu releases.
What kind of attack does CVE-2018-7492 enable?
CVE-2018-7492 allows local attackers to cause a system panic, resulting in a denial-of-service.
Is there a patch available for CVE-2018-7492?
Yes, patches are available for CVE-2018-7492 in the form of updated kernel releases for affected systems.