7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.1 High
AI Score
Confidence
High
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.003 Low
EPSS
Percentile
64.9%
USN-3653-1 fixed vulnerabilities and added mitigations in the Linux
kernel for Ubuntu 17.10. This update provides the corresponding
updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu
17.10 for Ubuntu 16.04 LTS.
Jann Horn and Ken Johnson discovered that microprocessors utilizing
speculative execution of a memory read may allow unauthorized memory
reads via a sidechannel attack. This flaw is known as Spectre
Variant 4. A local attacker could use this to expose sensitive
information, including kernel memory. (CVE-2018-3639)
It was discovered that the netlink subsystem in the Linux kernel did not
properly restrict observations of netlink messages to the appropriate net
namespace. A local attacker could use this to expose sensitive information
(kernel netlink traffic). (CVE-2017-17449)
Tuba Yavuz discovered that a double-free error existed in the USBTV007
driver of the Linux kernel. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2017-17975)
It was discovered that a race condition existed in the Device Mapper
component of the Linux kernel. A local attacker could use this to cause a
denial of service (system crash). (CVE-2017-18203)
It was discovered that an infinite loop could occur in the madvise(2)
implementation in the Linux kernel in certain circumstances. A local
attacker could use this to cause a denial of service (system hang).
(CVE-2017-18208)
Silvio Cesare discovered a buffer overwrite existed in the NCPFS
implementation in the Linux kernel. A remote attacker controlling a
malicious NCPFS server could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2018-8822)
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Ubuntu | 16.04 | noarch | linux-image-4.13.0-1017-gcp | < 4.13.0-1017.21 | UNKNOWN |
Ubuntu | 16.04 | noarch | linux-cloud-tools-4.13.0-1017-gcp | < 4.13.0-1017.21 | UNKNOWN |
Ubuntu | 16.04 | noarch | linux-gcp-cloud-tools-4.13.0-1017 | < 4.13.0-1017.21 | UNKNOWN |
Ubuntu | 16.04 | noarch | linux-gcp-cloud-tools-4.13.0-1017-dbgsym | < 4.13.0-1017.21 | UNKNOWN |
Ubuntu | 16.04 | noarch | linux-gcp-headers-4.13.0-1017 | < 4.13.0-1017.21 | UNKNOWN |
Ubuntu | 16.04 | noarch | linux-gcp-tools-4.13.0-1017 | < 4.13.0-1017.21 | UNKNOWN |
Ubuntu | 16.04 | noarch | linux-gcp-tools-4.13.0-1017-dbgsym | < 4.13.0-1017.21 | UNKNOWN |
Ubuntu | 16.04 | noarch | linux-headers-4.13.0-1017-gcp | < 4.13.0-1017.21 | UNKNOWN |
Ubuntu | 16.04 | noarch | linux-image-4.13.0-1017-gcp-dbgsym | < 4.13.0-1017.21 | UNKNOWN |
Ubuntu | 16.04 | noarch | linux-image-extra-4.13.0-1017-gcp | < 4.13.0-1017.21 | UNKNOWN |
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.1 High
AI Score
Confidence
High
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.003 Low
EPSS
Percentile
64.9%