CVE-2018-5332 Information

Description

In the Linux kernel through 4.14.13 the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).

CVSS Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c095508770aebf1b9218e77026e48345d719b17c http://www.securityfocus.com/bid/102507 https://access.redhat.com/errata/RHSA-2018:0470 https://github.com/torvalds/linux/commit/c095508770aebf1b9218e77026e48345d719b17c https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html https://usn.ubuntu.com/3617-1/ https://usn.ubuntu.com/3617-2/ https://usn.ubuntu.com/3617-3/ https://usn.ubuntu.com/3619-1/ https://usn.ubuntu.com/3619-2/ https://usn.ubuntu.com/3620-1/ https://usn.ubuntu.com/3620-2/ https://usn.ubuntu.com/3632-1/ https://www.debian.org/security/2018/dsa-4187

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

7.8