crítica
CVE-2018-20961
kernel: double free vulnerability in function f_midi_set_alt in drivers/usb/gadget/function/f_midi.c causing denial of service
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.4CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según Red Hat (media), Ubuntu (media).
Descripción
In the Linux kernel before 4.16.4, a double free vulnerability in the f_midi_set_alt function of drivers/usb/gadget/function/f_midi.c in the f_midi driver may allow attackers to cause a denial of service or possibly have unspecified other impact.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 2.0 | linux, linux-aws, linux-esx y 1 más | 4.9.189-1.ph2 y 1 más |
| debian 11 | linux | 4.16.5-1 |
| debian 12 | linux | 4.16.5-1 |
| debian 13 | linux | 4.16.5-1 |
| debian 14 | linux | 4.16.5-1 |
| debian 9 | linux | 4.9.107-1 |
| echo | linux | 4.16.5-1 |
| root.io debian 11 | rootio-linux | 4.16.5-1 |
| root.io debian 12 | rootio-linux | 4.16.5-1 |
| root.io debian 13 | rootio-linux | 4.16.5-1 |
| ubuntu 14.04-ESM | linux-aws, linux-lts-xenial | 4.4.0-1055.59 y 1 más |
| ubuntu 16.04 | linux, linux-gcp, linux-hwe y 3 más | 4.4.0-165.193 y 4 más |
Mostrar las 35 entradas de 15 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 2.0 | linux | 4.9.189-1.ph2 |
| Photon OS 2.0 | linux-aws | 4.9.180-1.ph2 |
| Photon OS 2.0 | linux-esx | 4.9.180-1.ph2 |
| Photon OS 2.0 | linux-secure | 4.9.180-1.ph2 |
| debian 11 | linux | 4.16.5-1 |
| debian 12 | linux | 4.16.5-1 |
| debian 13 | linux | 4.16.5-1 |
| debian 14 | linux | 4.16.5-1 |
| debian 9 | linux | 4.9.107-1 |
| echo | linux | 4.16.5-1 |
| root.io debian 11 | rootio-linux | 4.16.5-1 |
| root.io debian 12 | rootio-linux | 4.16.5-1 |
| root.io debian 13 | rootio-linux | 4.16.5-1 |
| ubuntu 14.04-ESM | linux-aws | 4.4.0-1055.59 |
| ubuntu 14.04-ESM | linux-lts-xenial | 4.4.0-165.193~14.04.1 |
| ubuntu 16.04 | linux | 4.4.0-165.193 |
| ubuntu 16.04 | linux-gcp | 4.15.0-1014.14~16.04.1 |
| ubuntu 16.04 | linux-hwe | 4.15.0-24.26~16.04.1 |
| ubuntu 16.04 | linux-hwe-edge | 4.15.0-24.26~16.04.1 |
| ubuntu 16.04 | linux-raspi2 | 4.4.0-1123.132 |
| ubuntu 16.04 | linux-snapdragon | 4.4.0-1127.135 |
| ubuntu 16.04-ESM | linux | 4.4.0-165.193 |
| ubuntu 16.04-ESM | linux-gcp | 4.15.0-1014.14~16.04.1 |
| ubuntu 16.04-ESM | linux-hwe | 4.15.0-24.26~16.04.1 |
| ubuntu 16.04-ESM | linux-hwe-edge | 4.15.0-24.26~16.04.1 |
| ubuntu 18.04 | linux | 4.15.0-24.26 |
| ubuntu 18.04 | linux-gcp | 4.15.0-1010.10 |
| ubuntu 18.04 | linux-gcp-edge | 4.15.0-1010.10 |
| ubuntu 18.04 | linux-oem | 4.15.0-1009.12 |
| ubuntu 18.04 | linux-raspi2 | 4.15.0-1013.14 |
| ubuntu 18.04 | linux-snapdragon | 4.15.0-1053.57 |
| ubuntu 18.04-ESM | linux | 4.15.0-24.26 |
| ubuntu 18.04-ESM | linux-gcp | 4.15.0-1010.10 |
| ubuntu 18.04-ESM | linux-gcp-edge | 4.15.0-1010.10 |
| ubuntu 18.04-ESM | linux-oem | 4.15.0-1009.12 |
Referencias
- http://packetstormsecurity.com/files/154228/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
- https://access.redhat.com/security/cve/CVE-2018-20961
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.4
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7fafcfdf6377b18b2a726ea554d6e593ba44349f
- https://github.com/torvalds/linux/commit/7fafcfdf6377b18b2a726ea554d6e593ba44349f
- https://nvd.nist.gov/vuln/detail/CVE-2018-20961
- https://seclists.org/bugtraq/2019/Aug/48
Las 14 referencias
- https://security.netapp.com/advisory/ntap-20190905-0002/
- https://support.f5.com/csp/article/K58502654
- https://support.f5.com/csp/article/K58502654?utm_source=f5support&%3Butm_medium=RSS
- https://ubuntu.com/security/notices/USN-4145-1
- https://usn.ubuntu.com/4145-1/
- https://www.cve.org/CVERecord?id=CVE-2018-20961