CVE-2018-17972

An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
Affected Products (NVD)
VendorProductVersion
linuxlinux_kernel
𝑥
≤ 4.18.11
canonicalubuntu_linux
12.04
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
18.10
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server
7.6
redhatenterprise_linux_server_aus
7.6
redhatenterprise_linux_server_eus
7.6
redhatenterprise_linux_server_tus
7.6
redhatenterprise_linux_workstation
7.0
debiandebian_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bookworm
6.1.106-3
fixed
bookworm (security)
6.1.112-1
fixed
bullseye
5.10.223-1
fixed
bullseye (security)
5.10.226-1
fixed
sid
6.11.5-1
fixed
trixie
6.11.5-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
bionic
Fixed 4.15.0-44.47
released
cosmic
Fixed 4.18.0-12.13
released
trusty
Fixed 3.13.0-165.215
released
xenial
Fixed 4.4.0-139.165
released
linux-aws
bionic
Fixed 4.15.0-1032.34
released
cosmic
Fixed 4.18.0-1006.7
released
trusty
Fixed 4.4.0-1034.37
released
xenial
Fixed 4.4.0-1072.82
released
linux-aws-hwe
bionic
dne
cosmic
dne
trusty
dne
xenial
Fixed 4.15.0-1032.34~16.04.1
released
linux-azure
bionic
Fixed 4.15.0-1037.39
released
cosmic
Fixed 4.18.0-1006.6
released
trusty
Fixed 4.15.0-1037.39~14.04.2
released
xenial
Fixed 4.15.0-1037.39~16.04.1
released
linux-azure-edge
bionic
Fixed 4.15.0-1037.39
released
cosmic
dne
trusty
dne
xenial
Fixed 4.15.0-1037.39~16.04.1
released
linux-euclid
bionic
dne
cosmic
dne
trusty
dne
xenial
ignored
linux-flo
bionic
dne
cosmic
dne
trusty
dne
xenial
ignored
linux-gcp
bionic
Fixed 4.15.0-1027.28
released
cosmic
Fixed 4.18.0-1004.5
released
trusty
dne
xenial
Fixed 4.15.0-1027.28~16.04.1
released
linux-gcp-edge
bionic
not-affected
cosmic
dne
trusty
dne
xenial
dne
linux-gke
bionic
dne
cosmic
dne
trusty
dne
xenial
ignored
linux-goldfish
bionic
dne
cosmic
dne
trusty
dne
xenial
ignored
linux-grouper
bionic
dne
cosmic
dne
trusty
dne
xenial
dne
linux-hwe
bionic
not-affected
cosmic
dne
trusty
dne
xenial
Fixed 4.15.0-45.48~16.04.1
released
linux-hwe-edge
bionic
not-affected
cosmic
dne
trusty
dne
xenial
Fixed 4.15.0-45.48~16.04.1
released
linux-kvm
bionic
Fixed 4.15.0-1029.29
released
cosmic
Fixed 4.18.0-1005.5
released
trusty
dne
xenial
Fixed 4.4.0-1037.43
released
linux-lts-trusty
bionic
dne
cosmic
dne
trusty
dne
xenial
dne
linux-lts-utopic
bionic
dne
cosmic
dne
trusty
dne
xenial
dne
linux-lts-vivid
bionic
dne
cosmic
dne
trusty
dne
xenial
dne
linux-lts-wily
bionic
dne
cosmic
dne
trusty
dne
xenial
dne
linux-lts-xenial
bionic
dne
cosmic
dne
trusty
Fixed 4.4.0-139.165~14.04.1
released
xenial
dne
linux-maguro
bionic
dne
cosmic
dne
trusty
dne
xenial
dne
linux-mako
bionic
dne
cosmic
dne
trusty
dne
xenial
ignored
linux-manta
bionic
dne
cosmic
dne
trusty
dne
xenial
dne
linux-oem
bionic
Fixed 4.15.0-1033.38
released
cosmic
Fixed 4.15.0-1033.38
released
trusty
dne
xenial
ignored
linux-oracle
bionic
Fixed 4.15.0-1008.10
released
cosmic
not-affected
trusty
dne
xenial
Fixed 4.15.0-1008.10~16.04.1
released
linux-raspi2
bionic
Fixed 4.15.0-1031.33
released
cosmic
Fixed 4.18.0-1007.9
released
trusty
dne
xenial
Fixed 4.4.0-1100.108
released
linux-snapdragon
bionic
not-affected
cosmic
dne
trusty
dne
xenial
Fixed 4.4.0-1104.109
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
kernel-azure
suse enterprise sap 12 SP3
4.4.180-4.31.1
fixed
suse enterprise server 12 SP3
4.4.180-4.31.1
fixed
kernel-azure-base
suse enterprise sap 12 SP3
4.4.180-4.31.1
fixed
suse enterprise server 12 SP3
4.4.180-4.31.1
fixed
kernel-default
suse enterprise sap 12 SP3
4.4.180-94.97.1
fixed
suse enterprise server 12
3.12.61-52.154.1
fixed
suse enterprise server 12 SP1
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP2
4.4.121-92.114.1
fixed
suse enterprise server 12 SP3
4.4.180-94.97.1
fixed
kernel-default-base
suse enterprise sap 12 SP3
4.4.180-94.97.1
fixed
suse enterprise server 12
3.12.61-52.154.1
fixed
suse enterprise server 12 SP1
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP2
4.4.121-92.114.1
fixed
suse enterprise server 12 SP3
4.4.180-94.97.1
fixed
kernel-default-man
suse enterprise sap 12 SP3
4.4.180-94.97.1
fixed
suse enterprise server 12
3.12.61-52.154.1
fixed
suse enterprise server 12 SP1
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP2
4.4.121-92.114.1
fixed
suse enterprise server 12 SP3
4.4.180-94.97.1
fixed
kernel-ec2
suse enterprise sap 12
3.12.74-60.64.115.1
fixed
suse enterprise sap 12 SP3
3.12.74-60.64.115.1
fixed
suse enterprise sap 12 SP4
3.12.74-60.64.115.1
fixed
suse enterprise sap 12 SP5
3.12.74-60.64.115.1
fixed
suse enterprise server 12
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP3
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP4
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP5
3.12.74-60.64.115.1
fixed
kernel-ec2-extra
suse enterprise sap 12
3.12.74-60.64.115.1
fixed
suse enterprise sap 12 SP3
3.12.74-60.64.115.1
fixed
suse enterprise sap 12 SP4
3.12.74-60.64.115.1
fixed
suse enterprise sap 12 SP5
3.12.74-60.64.115.1
fixed
suse enterprise server 12
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP3
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP4
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP5
3.12.74-60.64.115.1
fixed
kernel-macros
suse enterprise sap 12 SP3
4.4.180-94.97.1
fixed
suse enterprise server 12
3.12.61-52.154.1
fixed
suse enterprise server 12 SP1
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP2
4.4.121-92.114.1
fixed
suse enterprise server 12 SP3
4.4.180-94.97.1
fixed
kernel-source
suse enterprise sap 12 SP3
4.4.180-94.97.1
fixed
suse enterprise server 12
3.12.61-52.154.1
fixed
suse enterprise server 12 SP1
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP2
4.4.121-92.114.1
fixed
suse enterprise server 12 SP3
4.4.180-94.97.1
fixed
kernel-source-azure
suse enterprise sap 12 SP3
4.4.180-4.31.1
fixed
suse enterprise server 12 SP3
4.4.180-4.31.1
fixed
kernel-syms
suse enterprise sap 12 SP3
4.4.180-94.97.1
fixed
suse enterprise server 12
3.12.61-52.154.1
fixed
suse enterprise server 12 SP1
3.12.74-60.64.115.1
fixed
suse enterprise server 12 SP2
4.4.121-92.114.1
fixed
suse enterprise server 12 SP3
4.4.180-94.97.1
fixed
kernel-syms-azure
suse enterprise sap 12 SP3
4.4.180-4.31.1
fixed
suse enterprise server 12 SP3
4.4.180-4.31.1
fixed
kernel-xen
suse enterprise server 12
3.12.61-52.154.1
fixed
suse enterprise server 12 SP1
3.12.74-60.64.115.1
fixed
kernel-xen-base
suse enterprise server 12
3.12.61-52.154.1
fixed
suse enterprise server 12 SP1
3.12.74-60.64.115.1
fixed
kgraft-patch-3_12_61-52_154-default-1
suse enterprise server 12
1.5.1
fixed
kgraft-patch-3_12_61-52_154-xen-1
suse enterprise server 12
1.5.1
fixed
kgraft-patch-3_12_74-60_64_115-default-1
suse enterprise server 12 SP1
2.5.1
fixed
kgraft-patch-3_12_74-60_64_115-xen-1
suse enterprise server 12 SP1
2.5.1
fixed
kgraft-patch-4_4_121-92_114-default-1
suse enterprise server 12 SP2
3.5.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
bpftool
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel
RHEL 6
0:2.6.32-754.18.2.el6
fixed
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-abi-whitelists
RHEL 6
0:2.6.32-754.18.2.el6
fixed
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-bootwrapper
RHEL 6
0:2.6.32-754.18.2.el6
fixed
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-debug
RHEL 6
0:2.6.32-754.18.2.el6
fixed
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-debug-devel
RHEL 6
0:2.6.32-754.18.2.el6
fixed
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-devel
RHEL 6
0:2.6.32-754.18.2.el6
fixed
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-doc
RHEL 6
0:2.6.32-754.18.2.el6
fixed
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-firmware
RHEL 6
0:2.6.32-754.18.2.el6
fixed
kernel-headers
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-kdump
RHEL 6
0:2.6.32-754.18.2.el6
fixed
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-kdump-devel
RHEL 6
0:2.6.32-754.18.2.el6
fixed
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-rt
RHEL 7
0:3.10.0-957.10.1.rt56.921.el7
fixed
kernel-rt-debug
RHEL 7
0:3.10.0-957.10.1.rt56.921.el7
fixed
kernel-rt-debug-devel
RHEL 7
0:3.10.0-957.10.1.rt56.921.el7
fixed
kernel-rt-debug-kvm
RHEL 7
0:3.10.0-957.10.1.rt56.921.el7
fixed
kernel-rt-devel
RHEL 7
0:3.10.0-957.10.1.rt56.921.el7
fixed
kernel-rt-doc
RHEL 7
0:3.10.0-957.10.1.rt56.921.el7
fixed
kernel-rt-kvm
RHEL 7
0:3.10.0-957.10.1.rt56.921.el7
fixed
kernel-rt-trace
RHEL 7
0:3.10.0-957.10.1.rt56.921.el7
fixed
kernel-rt-trace-devel
RHEL 7
0:3.10.0-957.10.1.rt56.921.el7
fixed
kernel-rt-trace-kvm
RHEL 7
0:3.10.0-957.10.1.rt56.921.el7
fixed
kernel-tools
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-tools-libs
RHEL 7
0:3.10.0-957.10.1.el7
fixed
kernel-tools-libs-devel
RHEL 7
0:3.10.0-957.10.1.el7
fixed
perf
RHEL 6
0:2.6.32-754.18.2.el6
fixed
RHEL 7
0:3.10.0-957.10.1.el7
fixed
python-perf
RHEL 6
0:2.6.32-754.18.2.el6
fixed
RHEL 7
0:3.10.0-957.10.1.el7
fixed
References