CVE-2018-14656

Published: Oct 8, 2018Modified: Nov 21, 2024

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrary kernel address into the dmesg log.

Affected (2)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Up to 4.18
Linux Linux Kernel	Version 4.19 rc1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

http://www.securitytracker.com/id/1041804

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://bugs.chromium.org/p/project-zero/issues/detail?id=1650

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14656

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=342db04ae71273322f0011384a9ed414df8bdae4

Source: secalert@redhat.com

PatchThird Party Advisory

https://lore.kernel.org/lkml/20180828154901.112726-1-jannh%40google.com/T/

Source: secalert@redhat.com

https://seclists.org/oss-sec/2018/q4/9

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://www.securitytracker.com/id/1041804