CVE-2018-5333 Null dereference in n/a
A NULL pointer dereference in the Linux kernel RDS module allows local attackers to cause a system crash via crafted RDMA operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-5333?
CVE-2018-5333 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 11 Jan 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.
Weakness: CWE-476
Which versions are affected by CVE-2018-5333?
It affects 3 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Linux kernel.
How do I fix CVE-2018-5333?
Apply the vendor's patch.
Is CVE-2018-5333 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-5333 exists.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 1 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2018-5333, GHSA-fgqv-475c-x2p6, UBUNTU-CVE-2018-5333.