Back to search
CVE-2018-18397
Published: Dec 12, 2018
Modified: Aug 5, 2024
PUBLISHED
Description
The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
USN-3903-2
vendor-advisory
x_refsource_UBUNTU
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.87
x_refsource_MISC
USN-3901-2
vendor-advisory
x_refsource_UBUNTU
RHSA-2019:0324
vendor-advisory
x_refsource_REDHAT
https://bugs.chromium.org/p/project-zero/issues/detail?id=1700
x_refsource_MISC
RHSA-2019:0202
vendor-advisory
x_refsource_REDHAT
RHSA-2019:0163
vendor-advisory
x_refsource_REDHAT
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.7
x_refsource_MISC
USN-3901-1
vendor-advisory
x_refsource_UBUNTU
USN-3903-1
vendor-advisory
x_refsource_UBUNTU
RHSA-2019:0831
vendor-advisory
x_refsource_REDHAT
RHBA-2019:0327
vendor-advisory
x_refsource_REDHAT
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now