Vulnerability Details : CVE-2018-11237
An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.
Vulnerability category: OverflowMemory Corruption
Products affected by CVE-2018-11237
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_communications_broker:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_session_border_controller:8.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_session_border_controller:8.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_session_border_controller:8.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:element_software_management:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-11237
0.92%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 75 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-11237
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.6
|
MEDIUM | AV:L/AC:L/Au:N/C:P/I:P/A:P |
3.9
|
6.4
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2018-11237
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-11237
-
https://security.netapp.com/advisory/ntap-20190401-0001/
May 2018 GNU C Library Vulnerabilities in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://access.redhat.com/errata/RHBA-2019:0327
RHBA-2019:0327 - Bug Fix Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:3092
RHSA-2018:3092 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.securityfocus.com/bid/104256
GNU glibc CVE-2018-11237 Local Buffer Overflow VulnerabilityBroken Link
-
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Oracle Critical Patch Update - April 2019Patch;Third Party Advisory
-
https://sourceware.org/bugzilla/show_bug.cgi?id=23196
23196 – (CVE-2018-11237) __mempcpy_avx512_no_vzeroupper mishandles large copies (CVE-2018-11237)Issue Tracking;Patch;Third Party Advisory
-
https://usn.ubuntu.com/4416-1/
USN-4416-1: GNU C Library vulnerabilities | Ubuntu security notices | UbuntuThird Party Advisory
-
https://www.exploit-db.com/exploits/44750/
404 Page Not Found | Exploit DatabaseBroken Link;Third Party Advisory;VDB Entry
Jump to