CVE-2018-18559 Use after free in n/a
A race condition in the Linux kernel AF_PACKET socket handling allows attackers to achieve program counter control via use-after-free.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-18559?
CVE-2018-18559 is a high-severity use after free vulnerability in Linux kernel, published on 22 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.
Which versions are affected by CVE-2018-18559?
It affects 9 products.
Linux distribution packages (17)
kernel-rt Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-debug Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-debug-debuginfo Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-debug-devel Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-debug-kvm Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-debug-kvm-debuginfo Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-debuginfo Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-debuginfo-common-x86_64 Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-devel Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-doc Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-kvm Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-kvm-debuginfo Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-trace Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-trace-debuginfo Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-trace-devel Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-trace-kvm Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
kernel-rt-trace-kvm-debuginfo Red Hat:rhel_extras_rt:7 | All versions | 0:3.10.0-957.5.1.rt56.916.el7 |
Products include Linux kernel, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus, Redhat Enterprise Linux Server Tus and 3 more.
How do I fix CVE-2018-18559?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2018-18559 being exploited?
There is no known exploitation of CVE-2018-18559 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2018-18559, GHSA-8w88-57v8-p48h, RHSA-2019:0188, UBUNTU-CVE-2018-18559.