Lucene search

K
redhatcveRedhat.comRH:CVE-2018-1000199
HistoryApr 08, 2020 - 4:57 a.m.

CVE-2018-1000199

2020-04-0804:57:34
redhat.com
access.redhat.com
24

EPSS

0.001

Percentile

26.5%

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via β€˜modify_user_hw_breakpoint’ routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.

Mitigation

To mitigate this issue:

  1. Save the following script in a 'CVE-2018-1000199.stp' file.
    -–
    probe kernel.function("ptrace_set_debugreg") {
    if ($n < 4)
    $n = 4; /* set invalid debug register #, returns -EIO */
    }
    probe begin {
    printk(0, "CVE-2018-1000199 mitigation loaded")
    }
    probe end {
    printk(0, "CVE-2018-1000199 mitigation unloaded")
    }
    -–

  2. Install systemtap package and its dependencies

    yum install -y systemtap systemtap-runtime

    yum install -y kernel-devel kernel-debuginfo kernel-debuginfo-common

  3. Build the mitigation kernel module as root.

    stap -r uname -r -m cve_2018_1000199.ko -g CVE-2018-1000199.stp -p4

  4. Load the mitigation module as root

    staprun -L cve_2018_1000199.ko