| Revision Date: | 2018-12-27 | Version: | 1 | | Title: | CVE-2018-20511 on Ubuntu 19.04 (disco) - negligible. | | Description: | An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call. It was discovered that the Appletalk IP encapsulation driver in the Linux kernel did not properly prevent kernel addresses from being copied to user space. A local attacker with the CAP_NET_ADMIN capability could use this to expose sensitive information.
| | Family: | unix | Class: | vulnerability | | Status: | | Reference(s): | CVE-2018-20511
| | Platform(s): | Ubuntu 19.04
| Product(s): | | | Definition Synopsis | | Ubuntu 19.04 (disco) is installed. AND Package Information
linux package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-10.11').
OR linux-aws package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1002.3').
OR linux-azure package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1003.3').
OR linux-gcp package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1002.3').
OR linux-kvm package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1003.3').
OR linux-meta package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-10.11').
OR linux-meta-aws package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1002.3').
OR linux-meta-azure package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1003.3').
OR linux-meta-gcp package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1002.3').
OR linux-meta-kvm package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1003.3').
OR linux-meta-oem package in disco was vulnerable but has been fixed (note: '4.15.0-1050.57').
OR linux-meta-oracle package in disco was vulnerable but has been fixed (note: '5.0.0-1004.8').
OR linux-meta-raspi2 package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1005.7').
OR linux-oem package in disco was vulnerable but has been fixed (note: '4.15.0-1050.57').
OR linux-oracle package in disco was vulnerable but has been fixed (note: '5.0.0-1004.8').
OR linux-raspi2 package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1005.7').
OR linux-signed package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-10.11').
OR linux-signed-azure package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1003.3').
OR linux-signed-gcp package in disco, is related to the CVE in some way and has been fixed (note: '4.18.0-1002.3').
OR linux-signed-oem package in disco was vulnerable but has been fixed (note: '4.15.0-1050.57').
OR linux-signed-oracle package in disco was vulnerable but has been fixed (note: '5.0.0-1004.8').
OR linux-snapdragon package in disco, is related to the CVE in some way and has been fixed (note: '5.0.0-1010.10').
|
|