CVE-2018-1000004
kernel: Race condition in sound system can lead to denial of service
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition.
En el kernel de Linux en versiones 4.12, 3.10, 2.6 y, probablemente, versiones anteriores, existe una vulnerabilidad en el sistema de sonido, lo que puede conducir a un deadlock y a una condición de denegación de servicio (DoS).
In the Linux kernel versions 4.12, 3.10, 2.6, and possibly earlier, a race condition vulnerability exists in the sound system allowing for a potential deadlock and memory corruption due to use-after-free condition and thus denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
An update that fixes four vulnerabilities is now available. This update for the Linux Kernel 3.12.74-60_64_51 fixes several issues. The following security issues were fixed. An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver.A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-01-16 CVE Reserved
- 2018-01-16 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-07-24 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
References (18)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/104606 | Vdb Entry | |
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 | X_refsource_confirm | |
https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html | Mailing List |
|
https://www.oracle.com/security-alerts/cpujul2020.html | X_refsource_misc |
|
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html | X_refsource_misc |
|
URL | Date | SRC |
---|---|---|
http://seclists.org/oss-sec/2018/q1/51 | 2024-08-05 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://access.redhat.com/errata/RHSA-2018:0654 | 2020-07-15 | |
https://access.redhat.com/errata/RHSA-2018:0676 | 2020-07-15 | |
https://access.redhat.com/errata/RHSA-2018:1062 | 2020-07-15 | |
https://access.redhat.com/errata/RHSA-2018:2390 | 2020-07-15 | |
https://access.redhat.com/errata/RHSA-2019:1483 | 2020-07-15 | |
https://usn.ubuntu.com/3631-1 | 2020-07-15 | |
https://usn.ubuntu.com/3631-2 | 2020-07-15 | |
https://usn.ubuntu.com/3798-1 | 2020-07-15 | |
https://usn.ubuntu.com/3798-2 | 2020-07-15 | |
https://www.debian.org/security/2018/dsa-4187 | 2020-07-15 | |
https://access.redhat.com/security/cve/CVE-2018-1000004 | 2019-06-17 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1535315 | 2019-06-17 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | <= 2.6.0 Search vendor "Linux" for product "Linux Kernel" and version " <= 2.6.0" | - |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.10 Search vendor "Linux" for product "Linux Kernel" and version "3.10" | - |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 4.12 Search vendor "Linux" for product "Linux Kernel" and version "4.12" | - |
Affected
|