7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
75.0%
In the ea_get function in fs/jfs/xattr.c in the Linux kernel through
4.17.1, a memory corruption bug in JFS can be triggered by calling setxattr
twice with two different extended attribute names on the same file. This
vulnerability can be triggered by an unprivileged user with the ability to
create files and execute programs. A kmalloc call is incorrect, leading to
slab-out-of-bounds in jfs_xattr.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | linux | < 4.15.0-33.36 | UNKNOWN |
ubuntu | 14.04 | noarch | linux | < 3.13.0-157.207 | UNKNOWN |
ubuntu | 16.04 | noarch | linux | < 4.4.0-134.160 | UNKNOWN |
ubuntu | 18.04 | noarch | linux-aws | < 4.15.0-1020.20 | UNKNOWN |
ubuntu | 14.04 | noarch | linux-aws | < 4.4.0-1028.31 | UNKNOWN |
ubuntu | 16.04 | noarch | linux-aws | < 4.4.0-1066.76 | UNKNOWN |
ubuntu | 18.04 | noarch | linux-azure | < 4.15.0-1022.23 | UNKNOWN |
ubuntu | 16.04 | noarch | linux-azure | < 4.15.0-1022.22~16.04.1 | UNKNOWN |
ubuntu | 16.04 | noarch | linux-azure-edge | < 4.15.0-1022.23 | UNKNOWN |
ubuntu | 18.04 | noarch | linux-gcp | < 4.15.0-1018.19 | UNKNOWN |
launchpad.net/bugs/cve/CVE-2018-12233
lkml.org/lkml/2018/6/2/2
marc.info/?l=linux-kernel&m=152814391530549&w=2
nvd.nist.gov/vuln/detail/CVE-2018-12233
security-tracker.debian.org/tracker/CVE-2018-12233
ubuntu.com/security/notices/USN-3752-1
ubuntu.com/security/notices/USN-3752-2
ubuntu.com/security/notices/USN-3752-3
ubuntu.com/security/notices/USN-3753-1
ubuntu.com/security/notices/USN-3753-2
ubuntu.com/security/notices/USN-3754-1
www.cve.org/CVERecord?id=CVE-2018-12233
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
75.0%