CVE-2018-8781: Integer Overflow
Last updated 4 July 2026
Other sources
The Linux kernel from version 3.4 through 4.15 has an integer overflow vulnerability in the drivers/gpu/drm/udl/udlfb.c:udlfbmmap() function. An attacker with access to the udldrmfb driver could exploit this to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space.
Upstream Patch:
https://patchwork.freedesktop.org/patch/211845/
Mitre annoucement:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-8781
— Red Hat
The udlfbmmap function in drivers/gpu/drm/udl/udlfb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.16 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.105-1Fixed in 7.1.8-2Fixed in 7.1.10-1 - Upgrade
Upgrade
Linux kernel (drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap)to a version that resolves this vulnerability.Fixed in 4.15 - Compensating control
Remove or restrict unprivileged/local access to the udldrmfb driver on affected systems until the kernel is patched (only local users with access are able to exploit the udl_fb_mmap integer-overflow in drivers/gpu/drm/udl/udl_fb.c from Linux kernel versions 3.4 through 4.15).
Event History
Frequently Asked Questions
What is the severity of CVE-2018-8781?
The severity of CVE-2018-8781 is high with a severity value of 7.
What is the affected software for CVE-2018-8781?
The affected software for CVE-2018-8781 includes Ubuntu Linux with versions up to 4.16~, Ubuntu Linux Trusty with versions up to 3.13.0-151.201, Ubuntu Linux Xenial with versions up to 4.4.0-127.153, and Ubuntu Linux Artful with versions up to 4.13.0-45.50.
What is the remedy for CVE-2018-8781?
The remedy for CVE-2018-8781 is to update the Linux kernel to version 4.16~ or higher.
Where can I find more information about CVE-2018-8781?
You can find more information about CVE-2018-8781 at the following references: [Patchwork](https://patchwork.freedesktop.org/patch/211845/), [DSA-4187](https://www.debian.org/security/2018/dsa-4187), [DSA-4188](https://www.debian.org/security/2018/dsa-4188).
What is the CWE category of CVE-2018-8781?
The CWE category of CVE-2018-8781 is CWE-190 (Integer Overflow or Wraparound).