BDU:2019-02397

Уязвимость функции ext4_xattr_set_entry ядра операционной системы Linux, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями или вызвать отказ в обслуживании

Severity: MEDIUM (6.6) Vector: AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

CVE-2018-10840

Published: 2018-05-09

BDU:2021-01420

Уязвимость функции vhost_new_msg() ядра операционной системы Linux, позволяющая нарушителю получить доступ к конфиденциальным данным

Severity: MEDIUM (5.5) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References:

CVE-2018-1118

Published: 2018-07-16
Modified: 2024-11-21

CVE-2018-10840

Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image.

Severity: MEDIUM (6.6) Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Published: 2018-05-11
Modified: 2024-11-21

CVE-2018-1118

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

Severity: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References:

Published: 2018-05-24
Modified: 2024-11-21

CVE-2018-11412

In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode.

Severity: MEDIUM (5.9) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Version: 2.1.0

Branch p8 update on 2018-06-29

ALT-BU-2018-3329-1

ALT-PU-2018-1949-1

Closed vulnerabilities

BDU:2019-02397

BDU:2021-01420

CVE-2018-10840

CVE-2018-1118

CVE-2018-11412