Vulnerability Name:

CVE-2018-5344 (CCN-137649)

Assigned:2018-01-06
Published:2018-01-06
Updated:2020-08-24
Summary:In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
3.5 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
5.5 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
4.8 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-362
CWE-416
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2018-5344

Source: MISC
Type: Patch, Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5

Source: CCN
Type: IBM Security Bulletin 881053 (QRadar Network Security)
IBM QRadar Network Security is affected by Linux kernel vulnerabilities

Source: CCN
Type: IBM Security Bulletin 881424 (PowerKVM)
Vulnerabilities in the Linux Kernel affect PowerKVM

Source: BID
Type: Third Party Advisory, VDB Entry
102503

Source: REDHAT
Type: Third Party Advisory
RHSA-2018:2948

Source: REDHAT
Type: Third Party Advisory
RHSA-2018:3083

Source: REDHAT
Type: Third Party Advisory
RHSA-2018:3096

Source: XF
Type: UNKNOWN
linux-kernel-cve20185344-dos(137649)

Source: CCN
Type: Linux Kernel GIT Repository
loop: fix concurrent lo_open/lo_release

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5

Source: UBUNTU
Type: Third Party Advisory
USN-3583-1

Source: UBUNTU
Type: Third Party Advisory
USN-3583-2

Source: UBUNTU
Type: Third Party Advisory
USN-3617-1

Source: UBUNTU
Type: Third Party Advisory
USN-3617-2

Source: UBUNTU
Type: Third Party Advisory
USN-3617-3

Source: UBUNTU
Type: Third Party Advisory
USN-3619-1

Source: UBUNTU
Type: Third Party Advisory
USN-3619-2

Source: UBUNTU
Type: Third Party Advisory
USN-3632-1

Source: CCN
Type: IBM Security Bulletin 872832 (iDataPlex dx360 M4)
Multiple vulnerabilities affect Intel Manycore Platform Software Stack (Intel MPSS) for Linux and Windows

Vulnerable Configuration:Configuration 1:
  • cpe:/o:linux:linux_kernel:*:*:*:*:*:*:*:* (Version <= 4.14.13)

    • Configuration 2:
  • cpe:/o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:redhat:virtualization:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/a:redhat:rhel_extras_rt:7:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:linux:linux_kernel:4.14.13:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:powerkvm:3.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.redhat.rhsa:def:20183083
    P
    		RHSA-2018:3083: kernel security, bug fix, and enhancement update (Important)
    2018-10-30
    oval:com.redhat.rhsa:def:20183096
    P
    		RHSA-2018:3096: kernel-rt security, bug fix, and enhancement update (Important)
    2018-10-30
    oval:com.ubuntu.xenial:def:201853440000000
    V
    		CVE-2018-5344 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-01-12
    oval:com.ubuntu.trusty:def:20185344000
    V
    		CVE-2018-5344 on Ubuntu 14.04 LTS (trusty) - medium.
    2018-01-12
    oval:com.ubuntu.xenial:def:20185344000
    V
    		CVE-2018-5344 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-01-12
    oval:com.ubuntu.artful:def:20185344000
    V
    		CVE-2018-5344 on Ubuntu 17.10 (artful) - medium.
    2018-01-12
    oval:com.ubuntu.bionic:def:201853440000000
    V
    		CVE-2018-5344 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-01-12
    oval:com.ubuntu.bionic:def:20185344000
    V
    		CVE-2018-5344 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-01-12
    BACK
    linux linux kernel *
    canonical ubuntu linux 12.04
    canonical ubuntu linux 14.04
    canonical ubuntu linux 16.04
    canonical ubuntu linux 17.10
    redhat virtualization 4.0
    redhat enterprise linux desktop 7.0
    redhat enterprise linux server 7.0
    redhat enterprise linux workstation 7.0
    linux linux kernel 4.14.13
    ibm powerkvm 3.1