Vulnerability Description
A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | <= 4.14 |
| Redhat | Enterprise Linux | 7.0 |
| Canonical | Ubuntu Linux | 14.04 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/106009Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16862Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00034.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html
- https://lore.kernel.org/patchwork/patch/1011367/Issue TrackingPatchVendor Advisory
- https://seclists.org/oss-sec/2018/q4/169Mailing ListThird Party Advisory
- https://usn.ubuntu.com/3879-1/Third Party Advisory
- https://usn.ubuntu.com/3879-2/Third Party Advisory
- https://usn.ubuntu.com/4094-1/
- https://usn.ubuntu.com/4118-1/
- http://www.securityfocus.com/bid/106009Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16862Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00034.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2018-16862?
CVE-2018-16862 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain lef...
How severe is CVE-2018-16862?
CVE-2018-16862 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-16862?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Redhat Enterprise Linux, Canonical Ubuntu Linux, Debian Debian Linux.