CVE-2018-1000204 Information disclosure in n/a

What is CVE-2018-1000204?

CVE-2018-1000204 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 26 Jun 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually impossible to exploit.

Which versions are affected by CVE-2018-1000204?

It affects 3 products.

Products include Canonical Ubuntu Linux, Debian Debian Linux, Linux kernel.

How do I fix CVE-2018-1000204?

Apply the vendor's patch.

Is CVE-2018-1000204 being exploited?

There is no known exploitation of CVE-2018-1000204 in the wild and no public exploit code.

Other vulnerabilities in Canonical Ubuntu Linux

• CVE-2020-11651 SaltStack Salt Authentication Bypass Exploited Critical 9.8
• CVE-2020-7247 OpenSMTPD Remote Code Execution Exploited Critical 9.8
• CVE-2019-16928 Exim Out-of-bounds Write Exploited Critical 9.8
• CVE-2018-6789 Exim Buffer Overflow Exploited Critical 9.8
• CVE-2015-2590 Oracle Java SE and Java SE Embedded Remote Code Execution Exploited Critical 9.8

All Canonical Ubuntu Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2018-1000204, GHSA-xrfx-4wv5-78ww, UBUNTU-CVE-2018-1000204.