CVE-2018-7754

2018-08-1000:00:00

ubuntu.com

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

Percentile

5.1%

JSON

The aoedisk_debugfs_show function in drivers/block/aoe/aoeblk.c in the
Linux kernel through 4.16.4rc4 allows local users to obtain sensitive
address information by reading "ffree: " lines in a debugfs file.

Notes

Author	Note
tyhicks	Two mitigating factors for this issue are that debugfs files are restricted to root and KASLR is only used in 18.04 and newer

OSVersionArchitecturePackageVersionFilename
ubuntu16.04noarchlinux-azure< 4.15.0-1013.13~16.04.2UNKNOWN
ubuntu16.04noarchlinux-gcp< 4.15.0-1014.14~16.04.1UNKNOWN
ubuntu16.04noarchlinux-hwe< 4.15.0-24.26~16.04.1UNKNOWN
ubuntu16.04noarchlinux-hwe-edge< 4.15.0-24.26~16.04.1UNKNOWN
ubuntu18.04noarchlinux-snapdragon< 4.15.0-1053.57UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	16.04	noarch	linux-azure	< 4.15.0-1013.13~16.04.2	UNKNOWN
ubuntu	16.04	noarch	linux-gcp	< 4.15.0-1014.14~16.04.1	UNKNOWN
ubuntu	16.04	noarch	linux-hwe	< 4.15.0-24.26~16.04.1	UNKNOWN
ubuntu	16.04	noarch	linux-hwe-edge	< 4.15.0-24.26~16.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-snapdragon	< 4.15.0-1053.57	UNKNOWN