Vulnerability-Lookup

BDU:2019-01341 (CVE-2018-16884)

Vulnerability from fstec – Published: 2019-04-12 – Updated: 2024-06-18 – View on bdu.fstec.ru Fixed

Title

Уязвимость сервера NFS ядра операционных систем Linux, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость сервера NFS (NFS41+) ядра операционных систем Linux связана с использованием памяти после её освобождения. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Severity

7.7 (High) CVSS 2.0


                      
                        AV:A/AC:L/Au:S/C:C/I:C/A:C

8.0 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-416 - Использование после освобождения

Aliases

CVE-2018-16884

References

43 references

URL
http://www.securityfocus.com/bid/106253
https://access.redhat.com/errata/RHSA-2019:1873
https://access.redhat.com/errata/RHSA-2019:1891
https://access.redhat.com/errata/RHSA-2019:2696
https://access.redhat.com/errata/RHSA-2019:2730
https://access.redhat.com/errata/RHSA-2019:3309
https://access.redhat.com/errata/RHSA-2019:3517
https://access.redhat.com/errata/RHSA-2020:0204
https://bugzilla.redhat.com/show_bug.cgi?id=1660375
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16884
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16884
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.94
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.16
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.3
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.171
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.151
https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html
https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html
https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html
https://lore.kernel.org/linux-nfs/1b3282c0-12ce-0e2c-0fa9-63418a3f2a80@virtuozz…
https://patchwork.kernel.org/cover/10733767/
https://patchwork.kernel.org/patch/10733769/
https://support.f5.com/csp/article/K21430012
https://ubuntu.com/security/notices/USN-3932-1
https://ubuntu.com/security/notices/USN-3932-2
https://ubuntu.com/security/notices/USN-3980-1
https://ubuntu.com/security/notices/USN-3980-2
https://ubuntu.com/security/notices/USN-3981-1
https://ubuntu.com/security/notices/USN-3981-2
https://usn.ubuntu.com/3932-1/
https://usn.ubuntu.com/3932-2/
https://usn.ubuntu.com/3980-1/
https://usn.ubuntu.com/3980-2/
https://usn.ubuntu.com/3981-1/
https://usn.ubuntu.com/3981-2/
https://usn.ubuntu.com/usn/usn-3932-1
https://usn.ubuntu.com/usn/usn-3932-2
https://usn.ubuntu.com/usn/usn-3980-1
https://usn.ubuntu.com/usn/usn-3980-2
https://usn.ubuntu.com/usn/usn-3981-1
https://usn.ubuntu.com/usn/usn-3981-2
https://www.cve.org/CVERecord?id=CVE-2018-16884
https://www.oracle.com/security-alerts/cpuApr2021.html

Impacted products

6 products from 5 vendors

Vendors

Canonical Ltd., Red Hat, Inc., ООО «РусБИТех-Астра», Сообщество свободного программного обеспечения

Products

Ubuntu, Red Hat Enterprise Linux, Red Hat Enterprise MRG, Astra Linux Common Edition (запись в едином реестре российских программ №4433), Debian GNU/Linux, Linux

Versions

16.04 LTS (Ubuntu), 7.0 (Red Hat Enterprise Linux), 18.04 LTS (Ubuntu), 18.10 (Ubuntu), 2.0 (Red Hat Enterprise MRG), 2.12 «Орёл» (Astra Linux Common Edition), 14.04 ESM (Ubuntu), 8 (Debian GNU/Linux), от 4.0 до 4.4.170 включительно (Linux), от 4.5 до 4.9.150 включительно (Linux), от 4.10 до 4.14.93 включительно (Linux), от 4.15 до 4.19.15 включительно (Linux), от 4.20.0 до 4.20.2 включительно (Linux)

Product types

Operating system, Application software

Platforms

Canonical Ltd. Ubuntu 16.04 LTS, Red Hat, Inc. Red Hat Enterprise Linux 7.0, Canonical Ltd. Ubuntu 18.04 LTS, Canonical Ltd. Ubuntu 18.10, Сообщество свободного программного обеспечения Linux до 4.19.2 включительно, ООО «РусБИТех-Астра» Astra Linux Common Edition 2.12 «Орёл» (запись в едином реестре российских программ №4433), Canonical Ltd. Ubuntu 14.04 ESM, Сообщество свободного программного обеспечения Debian GNU/Linux 8

Mitigations

Использование рекомендаций: Для Linux: https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.94 https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.16 https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.3 https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.171 https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.151 Для Debian: https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html Для Astra Linux: Обновление программного обеспечения (пакета linux-4.9) до 4.9.110-3+deb9u5~deb8u1 или более поздней версии Для Ubuntu: https://usn.ubuntu.com/3932-1/ https://usn.ubuntu.com/3932-2/ https://usn.ubuntu.com/3980-1/ https://usn.ubuntu.com/3980-2/ https://usn.ubuntu.com/3981-1/ https://usn.ubuntu.com/3981-2/ Для программных продуктов Red Hat Inc.: https://access.redhat.com/errata/RHSA-2019:1873 https://access.redhat.com/errata/RHSA-2019:1891 https://access.redhat.com/errata/RHSA-2019:2696 https://access.redhat.com/errata/RHSA-2019:2730 https://access.redhat.com/errata/RHSA-2019:3309 https://access.redhat.com/errata/RHSA-2019:3517 https://access.redhat.com/errata/RHSA-2020:0204

JSON

To clipboard

{
  "CVSS 2.0": "AV:A/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., Red Hat, Inc., \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "16.04 LTS (Ubuntu), 7.0 (Red Hat Enterprise Linux), 18.04 LTS (Ubuntu), 18.10 (Ubuntu), 2.0 (Red Hat Enterprise MRG), 2.12 \u00ab\u041e\u0440\u0451\u043b\u00bb (Astra Linux Common Edition), 14.04 ESM (Ubuntu), 8 (Debian GNU/Linux), \u043e\u0442 4.0 \u0434\u043e 4.4.170 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.5 \u0434\u043e 4.9.150 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.10 \u0434\u043e 4.14.93 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.15 \u0434\u043e 4.19.15 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.20.0 \u0434\u043e 4.20.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.94\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.16\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.3\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.171\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.151\n\n\u0414\u043b\u044f Debian:\nhttps://lists.debian.org/debian-lts-announce/2019/03/msg00034.html\nhttps://lists.debian.org/debian-lts-announce/2019/04/msg00004.html\nhttps://lists.debian.org/debian-lts-announce/2019/05/msg00002.html\n\n\u0414\u043b\u044f Astra Linux:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f (\u043f\u0430\u043a\u0435\u0442\u0430 linux-4.9) \u0434\u043e 4.9.110-3+deb9u5~deb8u1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438\n\n\u0414\u043b\u044f Ubuntu:\nhttps://usn.ubuntu.com/3932-1/\nhttps://usn.ubuntu.com/3932-2/\nhttps://usn.ubuntu.com/3980-1/\nhttps://usn.ubuntu.com/3980-2/\nhttps://usn.ubuntu.com/3981-1/\nhttps://usn.ubuntu.com/3981-2/\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/errata/RHSA-2019:1873\nhttps://access.redhat.com/errata/RHSA-2019:1891\nhttps://access.redhat.com/errata/RHSA-2019:2696\nhttps://access.redhat.com/errata/RHSA-2019:2730\nhttps://access.redhat.com/errata/RHSA-2019:3309\nhttps://access.redhat.com/errata/RHSA-2019:3517\nhttps://access.redhat.com/errata/RHSA-2020:0204",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "17.12.2018",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "18.06.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "12.04.2019",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2019-01341",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2018-16884",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, Red Hat Enterprise Linux, Red Hat Enterprise MRG, Astra Linux Common Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164433), Debian GNU/Linux, Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Canonical Ltd. Ubuntu 16.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 7.0 , Canonical Ltd. Ubuntu 18.04 LTS , Canonical Ltd. Ubuntu 18.10 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u0434\u043e 4.19.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Common Edition 2.12 \u00ab\u041e\u0440\u0451\u043b\u00bb  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164433), Canonical Ltd. Ubuntu 14.04 ESM , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 8 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 NFS \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (CWE-416)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 NFS (NFS41+) \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://www.securityfocus.com/bid/106253\nhttps://access.redhat.com/errata/RHSA-2019:1873\nhttps://access.redhat.com/errata/RHSA-2019:1891\nhttps://access.redhat.com/errata/RHSA-2019:2696\nhttps://access.redhat.com/errata/RHSA-2019:2730\nhttps://access.redhat.com/errata/RHSA-2019:3309\nhttps://access.redhat.com/errata/RHSA-2019:3517\nhttps://access.redhat.com/errata/RHSA-2020:0204\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1660375\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16884\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16884\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.94\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.16\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.3\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.171\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.151\nhttps://lists.debian.org/debian-lts-announce/2019/03/msg00034.html\nhttps://lists.debian.org/debian-lts-announce/2019/04/msg00004.html\nhttps://lists.debian.org/debian-lts-announce/2019/05/msg00002.html\nhttps://lore.kernel.org/linux-nfs/1b3282c0-12ce-0e2c-0fa9-63418a3f2a80@virtuozzo.com/T/#m6b9e4d7efcc6b3564f9d53c051caf2370ae8e70a\nhttps://patchwork.kernel.org/cover/10733767/\nhttps://patchwork.kernel.org/patch/10733769/\nhttps://support.f5.com/csp/article/K21430012\nhttps://ubuntu.com/security/notices/USN-3932-1\nhttps://ubuntu.com/security/notices/USN-3932-2\nhttps://ubuntu.com/security/notices/USN-3980-1\nhttps://ubuntu.com/security/notices/USN-3980-2\nhttps://ubuntu.com/security/notices/USN-3981-1\nhttps://ubuntu.com/security/notices/USN-3981-2\nhttps://usn.ubuntu.com/3932-1/\nhttps://usn.ubuntu.com/3932-2/\nhttps://usn.ubuntu.com/3980-1/\nhttps://usn.ubuntu.com/3980-2/\nhttps://usn.ubuntu.com/3981-1/\nhttps://usn.ubuntu.com/3981-2/\nhttps://usn.ubuntu.com/usn/usn-3932-1\nhttps://usn.ubuntu.com/usn/usn-3932-2\nhttps://usn.ubuntu.com/usn/usn-3980-1\nhttps://usn.ubuntu.com/usn/usn-3980-2\nhttps://usn.ubuntu.com/usn/usn-3981-1\nhttps://usn.ubuntu.com/usn/usn-3981-2\nhttps://www.cve.org/CVERecord?id=CVE-2018-16884\nhttps://www.oracle.com/security-alerts/cpuApr2021.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-416",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,7)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8)"
}

CVE-2018-16884 (GCVE-0-2018-16884)

Vulnerability from cvelistv5 – Published: 2018-12-18 22:00 – Updated: 2024-08-05 10:32

Summary

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H

CWE

CWE-416

Assigner

redhat redhat root

References

22 references

URL	Tags
http://www.securityfocus.com/bid/106253	vdb-entryx_refsource_BID
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3932-1/	vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/3932-2/	vendor-advisoryx_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3981-1/	vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/3980-1/	vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/3980-2/	vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/3981-2/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2019:1873	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1891	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2696	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2730	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:3309	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:3517	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0204	vendor-advisoryx_refsource_REDHAT
https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…	x_refsource_CONFIRM
https://patchwork.kernel.org/patch/10733769/	x_refsource_CONFIRM
https://patchwork.kernel.org/cover/10733767/	x_refsource_CONFIRM
https://support.f5.com/csp/article/K21430012	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
[UNKNOWN]	kernel:	Affected: n/a

Date Public

2018-12-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:32:54.149Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "106253",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106253"
          },
          {
            "name": "[debian-lts-announce] 20190327 [SECURITY] [DLA 1731-1] linux security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html"
          },
          {
            "name": "[debian-lts-announce] 20190401 [SECURITY] [DLA 1731-2] linux regression update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html"
          },
          {
            "name": "USN-3932-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3932-1/"
          },
          {
            "name": "USN-3932-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3932-2/"
          },
          {
            "name": "[debian-lts-announce] 20190503 [SECURITY] [DLA 1771-1] linux-4.9 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html"
          },
          {
            "name": "USN-3981-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3981-1/"
          },
          {
            "name": "USN-3980-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3980-1/"
          },
          {
            "name": "USN-3980-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3980-2/"
          },
          {
            "name": "USN-3981-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3981-2/"
          },
          {
            "name": "RHSA-2019:1873",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1873"
          },
          {
            "name": "RHSA-2019:1891",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1891"
          },
          {
            "name": "RHSA-2019:2696",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2696"
          },
          {
            "name": "RHSA-2019:2730",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2730"
          },
          {
            "name": "RHSA-2019:3309",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3309"
          },
          {
            "name": "RHSA-2019:3517",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3517"
          },
          {
            "name": "RHSA-2020:0204",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0204"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16884"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://patchwork.kernel.org/patch/10733769/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://patchwork.kernel.org/cover/10733767/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K21430012"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kernel:",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-12-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the Linux kernel\u0027s NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-14T17:20:04.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "106253",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106253"
        },
        {
          "name": "[debian-lts-announce] 20190327 [SECURITY] [DLA 1731-1] linux security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html"
        },
        {
          "name": "[debian-lts-announce] 20190401 [SECURITY] [DLA 1731-2] linux regression update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html"
        },
        {
          "name": "USN-3932-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3932-1/"
        },
        {
          "name": "USN-3932-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3932-2/"
        },
        {
          "name": "[debian-lts-announce] 20190503 [SECURITY] [DLA 1771-1] linux-4.9 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html"
        },
        {
          "name": "USN-3981-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3981-1/"
        },
        {
          "name": "USN-3980-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3980-1/"
        },
        {
          "name": "USN-3980-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3980-2/"
        },
        {
          "name": "USN-3981-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3981-2/"
        },
        {
          "name": "RHSA-2019:1873",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1873"
        },
        {
          "name": "RHSA-2019:1891",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1891"
        },
        {
          "name": "RHSA-2019:2696",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2696"
        },
        {
          "name": "RHSA-2019:2730",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2730"
        },
        {
          "name": "RHSA-2019:3309",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3309"
        },
        {
          "name": "RHSA-2019:3517",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3517"
        },
        {
          "name": "RHSA-2020:0204",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0204"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16884"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://patchwork.kernel.org/patch/10733769/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://patchwork.kernel.org/cover/10733767/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K21430012"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-16884",
    "datePublished": "2018-12-18T22:00:00.000Z",
    "dateReserved": "2018-09-11T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:32:54.149Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2019-01341 (CVE-2018-16884)

CVE-2018-16884 (GCVE-0-2018-16884)

Tags

Sightings

Nomenclature

Related by attack behaviour