CVE-2018-20976

kernel: use-after-free in fs/xfs/xfs_super.c

An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Mrg Rhel Aus and 3 more

CVE-2018-20969

patch: do_ed_script in pch.c does not block strings beginning with a ! character

do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.

CVSS 3.0 · 7.8 High EPSS 2.7% KEV · Not listed

Vendors

Gnu Redhat

Products

Patch Enterprise Linux Rhel Aus and 3 more

CVE-2018-20856

kernel: Use-after-free in __blk_drain_queue() function in block/blk-core.c

An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 5 more

CVE-2018-20169

kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS

An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2018-1122

procps: Local privilege escalation in top

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.

CVSS 3.0 · 7.3 High EPSS 1.2% KEV · Not listed

Vendors

Canonical Debian Procps-ng Project and 1 more

Products

Ubuntu Linux Debian Linux Procps-ng and 6 more

CVE-2018-1120

kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service

A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).

CVSS 3.0 · 2.8 Low EPSS 7.1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 10 more

CVE-2018-1111

dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

CVSS 3.0 · 7.5 High EPSS 97.9% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Enterprise Linux Enterprise Linux Desktop and 8 more

CVE-2018-1087

Kernel: KVM: error in exception handling leads to wrong debug stack value

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.

CVSS 3.0 · 8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 13 more

CVE-2018-1068

kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c

A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 14 more

CVE-2018-18559

kernel: Use-after-free due to race condition in AF_PACKET implementation

In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.

CVSS 3.1 · 8.1 High EPSS 2.6% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Linux Desktop and 13 more

CVE-2018-18311

perl: Integer overflow leading to buffer overflow in Perl_my_setenv()

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVSS 3.0 · 9.8 Critical EPSS 11.7% KEV · Not listed

Vendors

Apple Canonical Debian and 5 more

Products

Mac Os X Ubuntu Linux Debian Linux and 20 more

CVE-2018-18281

kernel: TLB flush happens too late on mremap

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.

CVSS 3.0 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2018-16396

ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.

CVSS 3.0 · 8.1 High EPSS 8.0% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Enterprise Linux and 6 more

CVE-2018-13405

kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed

Vendors

Canonical Debian F5 and 3 more

Products

Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 31 more

CVE-2018-12207

hw: Machine Check Error on Page Size Change (IFU)

Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian F5 and 5 more

Products

Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 1538 more

CVE-2018-10901

kernel: kvm: vmx: host GDT limit corruption

A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Linux Desktop and 6 more

CVE-2018-10853

kernel: kvm: guest userspace to guest kernel write

A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest.

CVSS 3.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 6 more

CVE-2018-10675

kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact

The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Redhat

Products

Ubuntu Linux Linux Kernel Enterprise Linux and 13 more

CVE-2018-10360

file: out-of-bounds read via a crafted ELF file

The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.

CVSS 3.0 · 6.5 Medium EPSS 3.4% KEV · Not listed

Vendors

Canonical File Project Opensuse and 1 more

Products

Ubuntu Linux File Leap and 6 more

CVE-2018-1000805

python-paramiko: Authentication bypass in auth_handler.py

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

CVSS 3.1 · 8.8 High EPSS 4.4% KEV · Not listed

Vendors

Canonical Debian Paramiko and 1 more

Products

Ubuntu Linux Debian Linux Paramiko and 12 more