CVE-2018-14617
Ubuntu Security Notice USN-4094-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.
Se ha descubierto un problema en el kernel de Linux hasta la versión 4.17.10. Hay una desreferencia de puntero NULL y pánico en hfsplus_lookup() en fs/hfsplus/dir.c cuando se abre un archivo (que supuestamente es un enlace duro o hard link) en un sistema de archivos hfs+ que tiene datos de catálogo mal formados y se monta en modo de solo lectura sin un directorio de metadatos.
USN-3821-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly ensure that xattr information remained in inode bodies. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-07-26 CVE Reserved
- 2018-07-27 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-476: NULL Pointer Dereference
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/104917 | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.kernel.org/show_bug.cgi?id=200297 | 2024-08-05 |
| URL | Date | SRC |
|---|---|---|
| https://www.spinics.net/lists/linux-fsdevel/msg130021.html | 2019-08-13 |
| URL | Date | SRC |
|---|---|---|
| https://usn.ubuntu.com/3821-1 | 2019-08-13 | |
| https://usn.ubuntu.com/3821-2 | 2019-08-13 | |
| https://usn.ubuntu.com/4094-1 | 2019-08-13 | |
| https://usn.ubuntu.com/4118-1 | 2019-08-13 | |
| https://www.debian.org/security/2018/dsa-4308 | 2019-08-13 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | <= 4.17.10 Search vendor "Linux" for product "Linux Kernel" and version " <= 4.17.10" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||