CVE-2018-10877 — HIGH (7.3)

Vulnerability Description

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.

CVSS Score

7.3

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Canonical	Ubuntu Linux	14.04
Linux	Linux Kernel	4.16
Debian	Debian Linux	8.0
Redhat	Enterprise Linux	7.0

Related Weaknesses (CWE)

CWE-125

References

http://www.securityfocus.com/bid/104878
http://www.securityfocus.com/bid/106503Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:2948Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10877Issue TrackingPatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00020.htmlMailing ListThird Party Advisory
https://usn.ubuntu.com/3753-1/Third Party Advisory
https://usn.ubuntu.com/3753-2/Third Party Advisory
https://usn.ubuntu.com/3754-1/Third Party Advisory
https://usn.ubuntu.com/3871-1/Third Party Advisory
https://usn.ubuntu.com/3871-3/Third Party Advisory
https://usn.ubuntu.com/3871-4/Third Party Advisory
https://usn.ubuntu.com/3871-5/Third Party Advisory
http://www.securityfocus.com/bid/104878
http://www.securityfocus.com/bid/106503Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:2948Third Party Advisory

FAQ

What is CVE-2018-10877?

CVE-2018-10877 is a vulnerability with a CVSS score of 7.3 (HIGH). Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.

How severe is CVE-2018-10877?

CVE-2018-10877 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-10877?

Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux, Linux Linux Kernel, Debian Debian Linux, Redhat Enterprise Linux.