NetSight
IP …
medium5.5

CVE-2018-18397

The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local u…

Impact

The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 4.19.7
RedhatOpenshift Container Platform
Version 3.11
RedhatVirtualization Host
Version 4.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 7.4, 7.6
RedhatEnterprise Linux Server Eus
Versions 7.4, 7.5, 7.6
RedhatEnterprise Linux Server Tus
Versions 7.4, 7.6
RedhatEnterprise Linux Workstation
Version 7.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 18.10

Weakness classification

CWE-863

References