CVE-2018-10940

EPSS 0.54%
Veröffentlicht 09.05.2018 17:29:00
Zuletzt bearbeitet 21.11.2024 03:42:21
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 19

NVD 2 VulnDex Vulnerability Enrichment 9

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Linux ≫ Linux Kernel Version < 4.16.6

Debian ≫ Debian Linux Version7.0

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.54%	0.411

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.5	1.8	3.6	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	4.9	3.9	6.9	AV:L/AC:L/Au:N/C:N/I:N/A:C

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

https://access.redhat.com/errata/RHSA-2018:3083

https://access.redhat.com/errata/RHSA-2018:3096

https://usn.ubuntu.com/3754-1/

https://access.redhat.com/errata/RHSA-2018:2948

https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html

https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html

https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html

https://usn.ubuntu.com/3695-1/

https://usn.ubuntu.com/3695-2/

https://usn.ubuntu.com/3676-1/

Third Party Advisory

https://usn.ubuntu.com/3676-2/

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/06/msg00000.html

Third Party Advisory

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9de4ee40547fd315d4a0ed1dd15a2fa3559ad707

Patch

http://www.securityfocus.com/bid/104154

Third Party Advisory

VDB Entry

https://github.com/torvalds/linux/commit/9de4ee40547fd315d4a0ed1dd15a2fa3559ad707

Patch

https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.6

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2018-10940

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-10940

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-10940

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2018-10940