CVE-2018-10908

vdsm: calls to qemu-img are not protected by prlimit/ulimit

It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.

CVSS 3.0 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Ovirt Redhat

Products

Vdsm Enterprise Linux Virtualization

CVE-2018-10907

glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code

It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using 'alloca(3)'. An authenticated attacker could exploit this by mounting a gluster volume and sending a string longer that the fixed buffer size to cause crash or potential code execution.

CVSS 3.1 · 8.8 High EPSS 3.3% KEV · Not listed

Vendors

Debian Gluster Opensuse and 1 more

Products

Debian Linux Glusterfs Leap and 4 more

CVE-2018-10906

fuse: bypass of the "user_allow_other" restriction when SELinux is active

In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.

CVSS 3.0 · 5.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Fuse Project Redhat

Products

Debian Linux Fuse Enterprise Linux and 3 more

CVE-2018-10904

glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code

It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient access to modify the extended attributes of files on a gluster volume.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed

Vendors

Debian Gluster Opensuse and 1 more

Products

Debian Linux Glusterfs Leap and 4 more

CVE-2018-10902

kernel: MIDI driver race condition leads to a double-free

It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2018-10901

kernel: kvm: vmx: host GDT limit corruption

A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Linux Desktop and 6 more

CVE-2018-10897

yum-utils: reposync: improper path validation may lead to directory traversal

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.

CVSS 3.1 · 8.1 High EPSS 5.6% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Enterprise Linux Desktop Enterprise Linux Server and 3 more

CVE-2018-10896

cloud-init: default configuration disabled deletion of SSH host keys

The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Canonical Redhat

Products

Cloud-init Enterprise Linux Rhel Eus

CVE-2018-10894

keycloak: auth permitted with expired certs in SAML client

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Single Sign On Keycloak and 3 more

CVE-2018-10893

spice-client: Insufficient encoding checks for LZ can cause different integer/buffer overflows

Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code.

CVSS 3.0 · 7.6 High EPSS 2.4% KEV · Not listed

Vendors

Redhat Spice Project

Products

Enterprise Linux Spice

CVE-2018-10892

docker: container breakout without selinux in enforcing mode

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Docker Mobyproject Opensuse and 1 more

Products

Docker Moby Leap and 4 more

CVE-2018-10883

kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 5 more

CVE-2018-10882

kernel: stack-out-of-bounds write infs/jbd2/transaction.c

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 1 more

CVE-2018-10881

kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.

CVSS 3.0 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2018-10880

kernel: stack-out-of-bounds write in ext4_update_inline_data function

Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service.

CVSS 3.0 · 5.5 Medium EPSS 2.9% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 1 more

CVE-2018-10879

kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image.

CVSS 3.0 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 5 more

CVE-2018-10878

kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 5 more

CVE-2018-10877

kernel: out-of-bound access in ext4_ext_drop_refs function with a crafted ext4 image

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.

CVSS 3.0 · 7.3 High EPSS 2.2% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 1 more

CVE-2018-10876

kernel: use-after-free in jbd2_journal_commit_transaction funtion

A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image.

CVSS 3.0 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 1 more

CVE-2018-10875

ansible: ansible.cfg is being read from current working directory allowing possible code execution

A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Ansible Engine and 9 more