Memory Access Vulnerability in Linux Kernel Packages: CVE-2018-16885
Summary
UBUNTU-CVE-2018-16885: A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buffer length which causes the read beyond the buffer boundaries, in certain cases... Affects linux versions 3.11.0-12.19 – 3.13.0-98.145. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability affects various Linux kernel packages across different Ubuntu LTS versions, specifically versions 3.13, 4.4, and 4.15, which are used in Ubuntu 14.04, 16.04, and 18.04 respectively.
Vulnerability Detail
A flaw was discovered in the Linux kernel that allows userspace to invoke memcpy_fromiovecend() and similar functions with a zero offset and buffer length. This can lead to reading beyond the buffer boundaries, potentially causing a memory access fault and system halt due to accessing invalid memory addresses. The vulnerability primarily affects kernel version 3.10.x as shipped with Red Hat Enterprise Linux 7, but similar issues can arise in the affected Ubuntu packages.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the usage of the affected functions in your applications or avoid using the vulnerable kernel versions until the updates are applied. However, the best approach is to apply the patches as soon as they are available.
Conclusion
CVE-2018-16885 is a significant vulnerability affecting various Linux kernel packages in Ubuntu. It poses a risk of memory access faults and system crashes. Users are strongly encouraged to update their systems to the patched versions of the affected packages to mitigate this risk.
See every vulnerability recorded for linux →
FAQ
CVE-2018-16885 is a vulnerability in the Linux kernel that allows userspace to read beyond buffer boundaries, potentially leading to system crashes.
The affected packages include linux, linux-aws, linux-azure, linux-lts-xenial, and others across Ubuntu 14.04, 16.04, and 18.04.
The CVSS score for this vulnerability is 5.5, indicating a medium severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot apply the patches immediately, consider limiting the use of the affected functions in your applications as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
