vulnwire
5.9med

CVE-2018-1108

kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data.

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.9
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 77%
Public exploits
0
none known

kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.

Exploit prediction (EPSS)

1.70% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.05.9CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
NVD3.15.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA3.05.9CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • kernel drivers

Classification

Weakness
  • CWE-330 Use of Insufficiently Random Values
Technology feeds
Linux kernel (RSS, critical only)

References

  • usn.ubuntu.com /3752-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • usn.ubuntu.com /3752-3/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • usn.ubuntu.com /3718-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • securityfocus.com /bid/104055 · vdb-entry, x_refsource_BID, x_transferred
  • debian.org /security/2018/dsa-4188 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • usn.ubuntu.com /3718-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • usn.ubuntu.com /3752-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2018-1108 · x_refsource_CONFIRM, x_transferred
  • lists.debian.org /debian-lts-announce/2022/07/msg00000.html · mailing-list, x_refsource_MLIST, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.