CVE-2018-9363: Integer Overflow
A buffer overflow due to a singed-unsigned comparsion was found in hidpprocessreport() in the net/bluetooth/hidp/core.c in the Linux kernel. The buffer length is an unsigned int but gets cast to a signed int which in certain conditions can lead to a system panic and a denial-of-service.
Introduced by:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4b1b5877b514b276f0f31efe02388a9c2836728
Fixed by:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7992c18810e568b95c869b227137a2215702a805
Other sources
In the hidpprocessreport in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-65853588 References: Upstream kernel.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 7.1.13-1 - Upgrade
Upgrade
Linux kernel (net/bluetooth/hidp)to a version that resolves this vulnerability.Patch 7992c18810e568b95c869b227137a2215702a805 - Upgrade
Upgrade
Linux kernel (net/bluetooth/hidp)to a version that resolves this vulnerability.Patch a4b1b5877b514b276f0f31efe02388a9c2836728 - Compensating control
To reduce exposure to the Bluetooth HIDP code path while patching, restrict/block Bluetooth HIDP/BR/EDR connections (e.g., via network/bt access controls or firewall/ACL policies where applicable) on affected Android devices/hosts.
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2018-9363.
What is the severity of CVE-2018-9363?
The severity of CVE-2018-9363 is high.
Which software versions are affected by CVE-2018-9363?
CVE-2018-9363 affects Android kernel versions and various Ubuntu Linux packages.
Is user interaction required for exploitation of CVE-2018-9363?
No, user interaction is not needed for exploitation of CVE-2018-9363.
Where can I find more information about CVE-2018-9363?
You can find more information about CVE-2018-9363 in the references provided.