Vulnerability Details : CVE-2018-1091
In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2018-1091
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-1091
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 16 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-1091
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.9
|
MEDIUM | AV:L/AC:L/Au:N/C:N/I:N/A:C |
3.9
|
6.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2018-1091
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
-
[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.Assigned by: secalert@redhat.com (Secondary)
References for CVE-2018-1091
-
https://marc.info/?l=linuxppc-embedded&m=150535531910494&w=2
'[PATCH v2] powerpc/tm: Flush TM only if CPU has TM feature' - MARCPatch;Third Party Advisory
-
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.5
Patch;Vendor Advisory
-
https://access.redhat.com/errata/RHSA-2018:1318
RHSA-2018:1318 - Security Advisory - Red Hat Customer Portal
-
https://bugzilla.redhat.com/show_bug.cgi?id=1558149
1558149 – (CVE-2018-1091) CVE-2018-1091 kernel: guest kernel crash during core dump on POWER9 hostIssue Tracking;Third Party Advisory
-
https://access.redhat.com/security/cve/cve-2018-1091
CVE-2018-1091 - Red Hat Customer PortalThird Party Advisory
-
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c1fa0768a8713b135848f78fd43ffc208d8ded70
kernel/git/torvalds/linux.git - Linux kernel source treePatch;Vendor Advisory
-
http://openwall.com/lists/oss-security/2018/03/27/4
oss-security - CVE-2018-1091: Linux kernel: a KVM guest kernel crash during core dump on POWER9 hostMailing List;Third Party Advisory
-
https://github.com/torvalds/linux/commit/c1fa0768a8713b135848f78fd43ffc208d8ded70
powerpc/tm: Flush TM only if CPU has TM feature · torvalds/linux@c1fa076 · GitHubPatch;Third Party Advisory
Jump to