CVE-2018-18559
In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.61% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362, CWE-416
- Affected
- linux/linux kernel · redhat/openshift container platform · redhat/virtualization host · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server eus · redhat/enterprise linux server tus · redhat/enterprise linux workstation
- Source
- cve@mitre.org
References
- https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0163Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0188Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1170Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1190Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3967Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4159Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0174Third Party Advisory
- https://blogs.securiteam.com/index.php/archives/3731Exploit, Patch, Third Party Advisory
- https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0163Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0188Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1170Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1190Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3967Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4159Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0174Third Party Advisory
- https://blogs.securiteam.com/index.php/archives/3731Exploit, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.