// For flags

CVE-2018-1000004

kernel: Race condition in sound system can lead to denial of service

Severity Score

5.9
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition.

En el kernel de Linux en versiones 4.12, 3.10, 2.6 y, probablemente, versiones anteriores, existe una vulnerabilidad en el sistema de sonido, lo que puede conducir a un deadlock y a una condición de denegación de servicio (DoS).

In the Linux kernel versions 4.12, 3.10, 2.6, and possibly earlier, a race condition vulnerability exists in the sound system allowing for a potential deadlock and memory corruption due to use-after-free condition and thus denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

An update that fixes four vulnerabilities is now available. This update for the Linux Kernel 3.12.74-60_64_51 fixes several issues. The following security issues were fixed. An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver.A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-01-16 CVE Reserved
  • 2018-01-16 CVE Published
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • 2025-07-24 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
<= 2.6.0
Search vendor "Linux" for product "Linux Kernel" and version " <= 2.6.0"
-
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
3.10
Search vendor "Linux" for product "Linux Kernel" and version "3.10"
-
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
4.12
Search vendor "Linux" for product "Linux Kernel" and version "4.12"
-
Affected