CVE-2018-10877

HIGH7.3

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image

Published Jul 18, 2018

Modified 1 years ago

Details

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.

References

WEBhttp://www.securityfocus.com/bid/104878 WEBhttp://www.securityfocus.com/bid/106503 ADVISORYhttps://access.redhat.com/errata/RHSA-2018:2948 WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10877 WEBhttps://lists.debian.org/debian-lts-announce/2018/07/msg00020.html ADVISORYhttps://usn.ubuntu.com/3753-1/ADVISORYhttps://usn.ubuntu.com/3753-2/ADVISORYhttps://usn.ubuntu.com/3754-1/ADVISORYhttps://usn.ubuntu.com/3871-1/ADVISORYhttps://usn.ubuntu.com/3871-3/ADVISORYhttps://usn.ubuntu.com/3871-4/ADVISORYhttps://usn.ubuntu.com/3871-5/ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2018-10877

CVSS Analysis

CVSS v3.0

7.3

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness Type (CWE)

Memory Safety

CWE-125

Out-of-bounds Read

Ecosystems

Timeline

PublishedJul 18, 2018

ModifiedAug 5, 2024