USN-8924-1: Linux kernel vulnerabilities
Ubuntu patches old Linux kernel flaws that leak PIDs or crash via malicious XFS and f2fs images.
Ubuntu published USN-8924-1 for Linux kernel vulnerabilities. CVE-2017-5967 in timer stats can let a local attacker discover a real PID from inside a PID namespace. CVE-2018-13093 is an XFS inode-tracking flaw that a malicious filesystem image can use to crash the system when mounted. The notice also describes an f2fs metadata-validation issue with the same denial-of-service impact. No exploitation is reported.
- USN-8924-1 covers long-known Linux kernel flaws.
- CVE-2017-5967 lets a local attacker learn a real PID from inside a PID namespace.
- CVE-2018-13093 is an XFS inode-validation bug that a malicious image can crash when mounted.
- A separate f2fs metadata-validation issue can also crash the system via a crafted image.
Vulnerabilities mentionedAll →
- CVE-2017-59674.0<1%The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from…published · linux linux kernel
- CVE-2018-130935.52%An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3
It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real PID value while inside a PID namespace. A local attacker could use this to expose sensitive information. (CVE-2017-5967) Wen Xu discovered that the XFS file system implementation in the Linux kernel did not properly track inode validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13093) Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could…
This source does not provide full text. Read it at ubuntu.com.