huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2018-1000127: memcached: Integer Overflow in items.c:item_free()
Component: memcached
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Public date: 2017-04-27T00:00:00+00:00

memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.


Affected upstream versions: n/a
Fixed upstream versions: 1.4.37
Upstream repository: https://github.com/memcached/memcached
Upstream fix commit: a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00
CVE-2018-1000129: jolokia: Cross site scripting in the HTTP servlet
Component: jolokia
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2018-02-08T00:00:00+00:00

An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.

Statement: Red Hat Product Security has rated this issue as having security impact of Low for:
* Red Hat OpenStack Platform 9.0 (Mitaka)
* Red Hat OpenStack Platform 10.0 (Newton) 
* Red Hat OpenStack Platform 11.0 (Ocata)
* Red Hat OpenStack Platform 12.0 (Pike)

Although the affected code is present in shipped packages, data returned by Jolokia is correctly processed and invalid data is not used.  This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: v1.5.0
Upstream repository: https://github.com/rhuss/jolokia
Upstream fix commit: 5895d5c137c335e6b473e9dcb9baf748851bbc5f
CVE-2018-1000180: bouncycastle: flaw in the low-level interface to RSA key pair generator
Component: bouncycastle
Severity: Moderate
CWE: CWE-325 (Missing Cryptographic Step)
CVSS v3: 4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2018-04-18T00:00:00+00:00

A vulnerability was found in BouncyCastle. The number of iterations of the Miller-Rabin primality test was incorrectly calculated (according to FIPS 186-4 C.3). Under some circumstances, this could lead to the generation of weak RSA key pairs.

Statement: This issue affects the versions of bouncycastle as shipped with Red Hat Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having a security impact of Moderate. No update is planned for this product at this time. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Red Hat Satellite 6.5 isn't vulnerable to this issue, since it doesn't ship bouncycastle jar file anymore.

Affected upstream versions: n/a
Fixed upstream versions: r1v60
Upstream repository: https://github.com/bcgit/bc-java
Upstream fix commit: 22467b6e8fe19717ecdf201c0cf91bacf04a55ad
CVE-2018-1000200: kernel: NULL pointer dereference on OOM kill of large mlocked process
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-04-24T00:00:00+00:00

A flaw was found in the Linux kernel where an out of memory (oom) killing of a process that has large spans of mlocked memory can result in deferencing a NULL pointer, leading to denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v4.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 27ae357fa82be5ab73b2ef8d39dcb8ca2563483a
CVE-2018-1000204: kernel: Infoleak caused by incorrect handling of the SG_IO ioctl
Component: kernel
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 4.1 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2018-05-18T00:00:00+00:00

A malformed SG_IO ioctl issued for a SCSI device in the Linux kernel leads to a local kernel data leak manifesting in up to approximately 1000 memory pages copied to the userspace. The problem has limited scope as non-privileged users usually have no permissions to access SCSI device files.


Affected upstream versions: n/a
Fixed upstream versions: v4.17
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: a45b599ad808c3c982fdcdc12b0b8611c2f92824
CVE-2018-1000632: dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents
Component: dom4j
Severity: Moderate
CWE: CWE-88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'))
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2018-07-01T00:00:00+00:00

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.


Affected upstream versions: n/a
Fixed upstream versions: version-2.0.3
Upstream repository: https://github.com/dom4j/dom4j
Upstream fix commit: e598eb43d418744c4dbf62f647dd2381c9ce9387
CVE-2018-1000801: okular: Directory traversal in function unpackDocumentArchive() in core/document.cpp
Component: okular
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2018-09-06T00:00:00+00:00

A path traversal vulnerability has been discovered in Okular, in the way it creates temporary files when reading an Okular archive. Paths are read from content.xml and they are not properly sanitized before being used as template file names for the temporary files created when extracting the Okular archive, thus allowing a local attacker to write files outside the target temporary directory.


Affected upstream versions: n/a
Upstream repository: https://cgit.kde.org/okular.git
Upstream fix commit: 8ff7abc14d41906ad978b6bc67e69693863b9d47
CVE-2018-1000807: pyOpenSSL: Use-after-free in X509 object handling
Component: pyOpenSSL
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-11-29T00:00:00+00:00

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

Statement: This vulnerability is only present when a specific and uncommon usage pattern of pyOpenSSL occurs. Red Hat Product Security has audited our packages that use pyOpenSSL, and determined that software we distribute in Red Hat Enterprise Linux and Red Hat Virtualization does not use pyOpenSSL in such a way as to be vulnerable. Future updates may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: 17.5.0
Upstream repository: https://github.com/pyca/pyopenssl
Upstream fix commit: e73818600065821d588af475b024f4eb518c3509
CVE-2018-1000850: retrofit: Directory traversal in RequestBuilder allows manipulation of resources
Component: retrofit
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Public date: 2018-10-21T00:00:00+00:00

A flaw was found in Retrofit, where it allowed directory traversal via its RequestBuilder class. An attacker could use this flaw to access information or commands outside of its set permissions.


Affected upstream versions: n/a
Fixed upstream versions: parent-2.5.0
Upstream repository: https://github.com/square/retrofit
Upstream fix commit: b9a7f6ad72073ddd40254c0058710e87a073047d
CVE-2018-1000852: freerdp: out of bounds read in drdynvc_process_capability_request
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Public date: 2018-09-19T00:00:00+00:00

FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvc_main.c, drdynvc_process_capability_request that can result in The RDP server can read the client's memory.. This attack appear to be exploitable via RDPClient must connect the rdp server with echo option. This vulnerability appears to have been fixed in after commit 205c612820dac644d665b5bb1cdf437dc5ca01e3.


Affected upstream versions: n/a
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: baee520e3dd9be6511c45a14c5f5e77784de1471
CVE-2018-1000876: binutils: integer overflow leads to heap-based buffer overflow in objdump
Component: binutils
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L)
Public date: 2018-12-16T00:00:00+00:00

binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.

Statement: The issue is classified as moderate severity primarily because of the unlikelihood of running a 32bit compiled objdump and/or having a compiled binary that uses 32bit compiled binutils libraries to analyze binaries from a not trusted source. Moreover, binutils does not handle privileged operations, meaning exploitation is unlikely to lead to system compromise or escalation of privileges. Additionally, the impact is localized to the application itself, without affecting the broader system or network security. 

As per upstream binutils security policy this issue is not considered as a security flaw. Basically the key element of the policy that affects this is the understanding that analysis of untrusted binaries must always be done in a sandbox because the ELF format is open ended enough to make the analysis tools do anything, like including and processing arbitrary files.  This eliminates the only possible vulnerability vector here, which is the possibility of a user being tricked into downloading and analyzing an untrusted ELF without sandboxing.

See the binutils security policy for more details:
https://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt

Affected upstream versions: n/a
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: 3a551c7a1b80fca579461774860574eabfd7f18f
CVE-2018-1000877: libarchive: Double free in RAR decoder resulting in a denial of service
Component: libarchive
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-11-20T00:00:00+00:00

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.

Statement: This issue affects the versions of libarchive as shipped with Red Hat Enterprise Linux 7.

This issue did not affect the versions of libarchive as shipped with Red Hat Enterprise Linux 6.

Affected upstream versions: n/a
Fixed upstream versions: v3.4.0
Upstream repository: https://github.com/libarchive/libarchive
Upstream fix commit: 021efa522ad729ff0f5806c4ce53e4a6cc1daa31
CVE-2018-1000878: libarchive: Use after free in RAR decoder resulting in a denial of service
Component: libarchive
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-11-20T00:00:00+00:00

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.

Statement: This issue affects the versions of libarchive as shipped with Red Hat Enterprise Linux 7.

This issue did not affect the versions of libarchive as shipped with Red Hat Enterprise Linux 6.

Affected upstream versions: n/a
Fixed upstream versions: v3.4.0
Upstream repository: https://github.com/libarchive/libarchive
Upstream fix commit: bfcfe6f04ed20db2504db8a254d1f40a1d84eb28
CVE-2018-1002200: plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
Component: plexus-archiver
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-06-05T00:00:00+00:00

A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names. A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with malicious code or vulnerable configurations.


Affected upstream versions: unspecified < 3.6.0
Fixed upstream versions: 3.6.0
Upstream repository: https://github.com/codehaus-plexus/plexus-archiver
Upstream fix commit: f8f4233508193b70df33759ae9dc6154d69c2ea8
CVE-2018-10119: libreoffice: Use-after-free in sdstor/stgstrms.cxx:StgSmallStrm class allows for denial of service with crafted document
Component: libreoffice
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2018-01-28T00:00:00+00:00

sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.


Affected upstream versions: n/a
Fixed upstream versions: coda-1
Upstream repository: https://gerrit.libreoffice.org/core.git
Upstream fix commit: fdd41c995d1f719e92c6f083e780226114762f05
CVE-2018-10120: libreoffice: Out of bounds write in filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for denial of service with crafted document
Component: libreoffice
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2018-02-09T00:00:00+00:00

The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record.


Affected upstream versions: n/a
Fixed upstream versions: coda-1
Upstream repository: https://gerrit.libreoffice.org/core.git
Upstream fix commit: 017fcc2fcd00af17a97bd5463d89662404f57667
CVE-2018-10184: haproxy: Heap buffer overflow in mux_h2.c:h2_process_demux() can allow attackers to cause a denial of service
Component: haproxy
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 8.6 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2018-04-19T00:00:00+00:00

An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against the bufsize. The max_frame_size only applies to outgoing traffic and not to incoming, so if a large enough frame size is advertised in the SETTINGS frame, a wrapped frame will be defragmented into a temporary allocated buffer where the second fragment may overflow the heap by up to 16 kB. It is very unlikely that this can be exploited for code execution given that buffers are very short lived and their addresses not realistically predictable in production, but the likelihood of an immediate crash is absolutely certain.


Affected upstream versions: n/a
Fixed upstream versions: v1.8.8
Upstream repository: https://git.haproxy.org/haproxy-1.8.git
Upstream fix commit: cd117685f0cff4f2f5577ef6a21eaae96ebd9f28
CVE-2018-10194: ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c
Component: ghostscript
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-04-20T00:00:00+00:00

The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.

Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 39b1e54b2968620723bf32e96764c88797714879
CVE-2018-10360: file: out-of-bounds read via a crafted ELF file
Component: file
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.4 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2018-06-09T00:00:00+00:00

The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.


Affected upstream versions: n/a
Fixed upstream versions: FILE5_34
Upstream repository: https://github.com/file/file
Upstream fix commit: a642587a9c9e2dd7feacdf513c3643ce26ad3c22
CVE-2018-1064: libvirt: Incomplete fix for CVE-2018-5748 triggered by QEMU guest agent
Component: libvirt
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-03-14T00:00:00+00:00

An incomplete fix for CVE-2018-5748 that affects QEMU monitor leading to a resource exhaustion but now also triggered via QEMU guest agent.


Affected upstream versions: before 4.2.0-rc1
Fixed upstream versions: v4.2.0
Upstream repository: https://libvirt.org/git/libvirt.git
Upstream fix commit: fbf31e1a4cd19d6f6e33e0937a009775cd7d9513
CVE-2018-1065: kernel: netfilter: xtables NULL pointer dereference in ip6_tables.c:ip6t_do_table() leading to a crash
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-02-04T00:00:00+00:00

A flaw was found in the netfilter/iptables subsystem. A user with the netfilter modification capabilities could insert a rule which could panic the system.


Affected upstream versions: Linux kernel 4.15.0-rc9
Fixed upstream versions: v4.16
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 57ebd808a97d7c5b1e1afb937c2db22beba3c1f8
CVE-2018-1066: kernel: Null pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() when empty TargetInfo is returned in NTLMSSP setup negotiation response allowing to crash client's kernel
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2014-10-20T00:00:00+00:00

A flaw was found in the Linux kernel's client-side implementation of the cifs protocol. This flaw allows an attacker controlling the server to kernel panic a client which has the CIFS server mounted.


Affected upstream versions: Linux kernel 4.11
Fixed upstream versions: v4.11
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: cabfb3680f78981d26c078a26e5c748531257ebb
CVE-2018-10675: kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-08-19T00:00:00+00:00

The do_get_mempolicy() function in mm/mempolicy.c in the Linux kernel allows local users to hit a use-after-free bug via crafted system calls and thus cause a denial of service (DoS) or possibly have unspecified other impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.


Affected upstream versions: n/a
Fixed upstream versions: v4.13
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 73223e4e2e3867ebf033a5a8eb2e5df0158ccc99
CVE-2018-1068: kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c
Component: kernel
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 8.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Public date: 2018-03-05T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.


Affected upstream versions: 4.x
Fixed upstream versions: v4.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b71812168571fa55e44cdd0254471331b9c4c4c6
CVE-2018-10689: blktrace: buffer overflow in the dev_map_read function in btt/devmap.c
Component: blktrace
Severity: Low
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
Public date: 2018-05-02T00:00:00+00:00

blktrace (aka Block IO Tracing) 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the dev_map_read function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file.

Statement: Red Hat Product Security has rated this issue as having a security impact of Low, and a future update may address this flaw.

Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git
Upstream fix commit: d61ff409cb4dda31386373d706ea0cfb1aaac5b7
CVE-2018-10853: kernel: kvm: guest userspace to guest kernel write
Component: kernel
Severity: Moderate
CWE: CWE-250 (Execution with Unnecessary Privileges)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-06-05T00:00:00+00:00

A flaw was found in the way Linux kernel KVM hypervisor emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest.


Affected upstream versions: 4.18
Fixed upstream versions: v4.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 129a72a0d3c8e139a04512325384fe5ac119e74