Vulnerability Description
In the Linux kernel before 4.16.4, a double free vulnerability in the f_midi_set_alt function of drivers/usb/gadget/function/f_midi.c in the f_midi driver may allow attackers to cause a denial of service or possibly have unspecified other impact.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 4.4, < 4.4.190 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/154228/Slackware-Security-Advisory-SlackwarThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSThird Party AdvisoryVDB Entry
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.4Release NotesVendor Advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7fafcExploitMailing ListVendor Advisory
- https://github.com/torvalds/linux/commit/7fafcfdf6377b18b2a726ea554d6e593ba44349PatchThird Party Advisory
- https://seclists.org/bugtraq/2019/Aug/48Mailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20190905-0002/Third Party Advisory
- https://support.f5.com/csp/article/K58502654Third Party Advisory
- https://support.f5.com/csp/article/K58502654?utm_source=f5support&%3Butm_medi
- https://usn.ubuntu.com/4145-1/Third Party Advisory
- http://packetstormsecurity.com/files/154228/Slackware-Security-Advisory-SlackwarThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSThird Party AdvisoryVDB Entry
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.4Release NotesVendor Advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7fafcExploitMailing ListVendor Advisory
- https://github.com/torvalds/linux/commit/7fafcfdf6377b18b2a726ea554d6e593ba44349PatchThird Party Advisory
FAQ
What is CVE-2018-20961?
CVE-2018-20961 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In the Linux kernel before 4.16.4, a double free vulnerability in the f_midi_set_alt function of drivers/usb/gadget/function/f_midi.c in the f_midi driver may allow attackers to cause a denial of serv...
How severe is CVE-2018-20961?
CVE-2018-20961 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-20961?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.