CVE-2018-7755: Infoleak
An issue was discovered in the fdlockedioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Frequently Asked Questions
What is CVE-2018-7755?
CVE-2018-7755 is a vulnerability that affects the Linux kernel through version 4.15.7.
How does CVE-2018-7755 affect the Linux kernel?
CVE-2018-7755 allows an attacker to copy a kernel pointer to user memory through the floppy driver's FDGETPRM ioctl.
What is the severity of CVE-2018-7755?
The severity of CVE-2018-7755 is low.
How can I fix CVE-2018-7755?
To fix CVE-2018-7755, update the Linux kernel to version 4.15.8 or later.
Where can I find more information about CVE-2018-7755?
You can find more information about CVE-2018-7755 on the following websites: [https://lkml.org/lkml/2018/3/7/1116](https://lkml.org/lkml/2018/3/7/1116), [https://marc.info/?l=linux-kernel&m=152046737321740&w=2](https://marc.info/?l=linux-kernel&m=152046737321740&w=2), [https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1553217](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1553217).