CVE-2018-7191: Null Pointer Dereference
A flaw was found in the Linux kernel's implementation of networking tunnel device ioctl. A local attacker can cause a denial of service (NULL pointer dereference and panic) via an ioctl (TUNSETIFF) call with a dev name containing a / character.
Other sources
In the tun subsystem in the Linux kernel before 4.13.14, devgetvalidname is not called before registernetdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.
In the tun subsystem in the Linux kernel, a local attacker could issue an ioctl to call devgetvalidname which is not called before registernetdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character.
Reference: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1743792 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.14
Commits: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0ad646c81b2182f7fa67ec0c8c825e0ee165696d https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5c25f65fd1e42685f7ccd80e0621829c105785d9
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in the tun subsystem. By sending a specially-crafted ioctl(TUNSETIFF) cal, a local attacker could exploit this vulnerability to cause a system panic.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-7191?
CVE-2018-7191 is classified as a high severity vulnerability due to the potential for denial of service.
How do I fix CVE-2018-7191?
To mitigate CVE-2018-7191, update your Linux kernel to a version greater than 4.13.14 or apply the applicable patches from your distribution provider.
Which versions of the Linux kernel are affected by CVE-2018-7191?
CVE-2018-7191 affects Linux kernel versions prior to 4.13.14.
Can CVE-2018-7191 be exploited remotely?
No, CVE-2018-7191 requires local access for exploitation, as it involves the use of ioctl calls.
What happens if CVE-2018-7191 is exploited?
Exploiting CVE-2018-7191 can lead to a denial of service condition due to a NULL pointer dereference and kernel panic.