Kernel Function Address Disclosure Vulnerability in Linux Package
Summary
UBUNTU-CVE-2018-7273: In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function show_floppy in drivers/block/floppy.c. Affects linux versions 3.11.0-12.19 – 3.13.0-98.145. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the operating system, providing essential functionalities for managing hardware and system resources. It is widely used in various distributions, including Ubuntu. This package is crucial for system stability and performance, but it is susceptible to vulnerabilities that can compromise system security. The specific vulnerability in question allows unauthorized access to sensitive information about kernel function addresses, which can be exploited by attackers.
Vulnerability Detail
In the Linux kernel through version 4.15.4, the floppy driver inadvertently exposes the addresses of kernel functions and global variables through printk calls within the function show_floppy in drivers/block/floppy.c. This information can be accessed via dmesg, allowing an attacker to locate kernel code and data, potentially bypassing security measures such as Kernel Address Space Layout Randomization (KASLR). The vulnerability has a CVSS score of 5.5, indicating a moderate level of risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the floppy driver if it is not needed for their system operations. This can be done by blacklisting the floppy module. To do this, add the following line to the /etc/modprobe.d/blacklist.conf file: blacklist floppy. After making this change, reboot the system for it to take effect.
Conclusion
The vulnerability in the Linux kernel's floppy driver poses a significant risk by exposing sensitive kernel function addresses. Users are strongly advised to update their systems to the latest patched version to protect against potential exploitation. Temporary workarounds are available for those unable to update immediately.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows attackers to read kernel function addresses, which can lead to exploitation of other vulnerabilities and bypassing security protections.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
Yes, a patched version of the Linux package is available. Users should update to version 4.15.0-1053.57 or later.
If immediate updates are not possible, consider blacklisting the floppy module as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
