imPC@ndo IT

Tracker / CVE-2018-18397

CVE-2018-18397

Medium 5.5

The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.

Affected products and versions

canonical ubuntu_linux
linux linux_kernel · … → 4.19.7
redhat enterprise_linux_desktop
redhat enterprise_linux_server
redhat enterprise_linux_server_aus
redhat enterprise_linux_server_eus
redhat enterprise_linux_server_tus
redhat enterprise_linux_workstation
redhat openshift_container_platform
redhat virtualization_host

Analysis

This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.

References