7.8

CVE-2018-11506

The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.11 < 4.14.45
Linux ≫ Linux Kernel Version >= 4.15 < 4.16.13
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Debian ≫ Debian Linux Version 8.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.39% 0.301
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://access.redhat.com/errata/RHSA-2018:2948
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/3752-1/
Third Party Advisory
https://usn.ubuntu.com/3752-2/
Third Party Advisory
https://usn.ubuntu.com/3752-3/
Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f7068114d45ec55996b9040e98111afa56e010fe
Patch
https://github.com/torvalds/linux/commit/f7068114d45ec55996b9040e98111afa56e010fe
Patch
https://twitter.com/efrmv/status/1001574894273007616
Third Party Advisory