| Vulnerability Name: | CVE-2018-14610 (CCN-147620) | ||||||||||||||||||||||||||||||||||||
| Assigned: | 2018-07-04 | ||||||||||||||||||||||||||||||||||||
| Published: | 2018-07-04 | ||||||||||||||||||||||||||||||||||||
| Updated: | 2020-06-10 | ||||||||||||||||||||||||||||||||||||
| Summary: | An issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in write_extent_buffer() when mounting and operating a crafted btrfs image, because of a lack of verification that each block group has a corresponding chunk at mount time, within btrfs_read_block_groups in fs/btrfs/extent-tree.c. | ||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) 4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 7.1 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C)
| ||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-787 CWE-125 | ||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2018-14610 Source: BID Type: Third Party Advisory, VDB Entry 104917 Source: CCN Type: BID-104917 Linux Kernel Multiple Denial of Service Vulnerabilities Source: CCN Type: Kernel.org Bugzilla Bug 199837 out-of-bound access in write_extent_buffer() when mounting and operating a crafted btrfs image Source: MISC Type: Exploit, Issue Tracking, Third Party Advisory https://bugzilla.kernel.org/show_bug.cgi?id=199837 Source: XF Type: UNKNOWN linux-kernel-cve201814610-dos(147620) Source: MLIST Type: UNKNOWN [debian-lts-announce] 20190315 [SECURITY] [DLA 1715-1] linux-4.9 security update Source: MLIST Type: UNKNOWN [debian-lts-announce] 20200609 [SECURITY] [DLA 2241-1] linux security update Source: MLIST Type: UNKNOWN [debian-lts-announce] 20200610 [SECURITY] [DLA 2241-2] linux security update Source: CCN Type: Patchwork Web site btrfs: Check each block group has corresponding chunk at mount time Source: MISC Type: Issue Tracking, Patch, Third Party Advisory https://patchwork.kernel.org/patch/10503415/ Source: UBUNTU Type: UNKNOWN USN-3932-1 Source: UBUNTU Type: UNKNOWN USN-3932-2 Source: UBUNTU Type: UNKNOWN USN-4094-1 Source: UBUNTU Type: UNKNOWN USN-4118-1 Source: CCN Type: WhiteSource Vulnerability Database CVE-2018-14610 | ||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||