QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2018-19854

Back to search

CVE-2018-19854

Published: Dec 4, 2018

Modified: Aug 5, 2024

PUBLISHED

Description

An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs. NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attacker does not need a capability (however, the system must have the CONFIG_CRYPTO_USER kconfig option).

VendorProductVersions

n/a

n/a

affected
n/a

References

USN-3872-1
vendor-advisory
x_refsource_UBUNTU
USN-3901-2
vendor-advisory
x_refsource_UBUNTU
USN-3878-1
vendor-advisory
x_refsource_UBUNTU
USN-3878-2
vendor-advisory
x_refsource_UBUNTU
USN-3901-1
vendor-advisory
x_refsource_UBUNTU
RHSA-2019:3309
vendor-advisory
x_refsource_REDHAT
RHSA-2019:3517
vendor-advisory
x_refsource_REDHAT

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now