crítica
CVE-2018-12714
kernel: slab out-of-bounds write in trace/trace_events_filter.c
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.1CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Ubuntu (media).
Descripción
An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter, which is an N=0 case when it expected at least one line to have been read, thus making the N-1 index invalid. This allows attackers to cause a denial of service (slab out-of-bounds write) or possibly have unspecified other impact via crafted perf_event_open and mmap system calls.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| ubuntu 18.04 | linux-hwe-edge | 4.18.0-8.9~18.04.1 |
| ubuntu 18.04-ESM | linux-azure-edge, linux-hwe-edge | 4.18.0-8.9~18.04.1 |
Mostrar las 3 entradas de 2 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| ubuntu 18.04 | linux-hwe-edge | 4.18.0-8.9~18.04.1 |
| ubuntu 18.04-ESM | linux-azure-edge | sin corrección indicada |
| ubuntu 18.04-ESM | linux-hwe-edge | 4.18.0-8.9~18.04.1 |
Referencias
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=81f9c4e4177d31ced6f52a89bb70e93bfb77ca03
- http://www.securityfocus.com/bid/104544
- https://access.redhat.com/security/cve/CVE-2018-12714
- https://bugzilla.kernel.org/show_bug.cgi?id=200019
- https://github.com/lcytxw/bug_repro/tree/master/bug_200019
- https://github.com/torvalds/linux/commit/81f9c4e4177d31ced6f52a89bb70e93bfb77ca03
- https://nvd.nist.gov/vuln/detail/CVE-2018-12714
- https://www.cve.org/CVERecord?id=CVE-2018-12714