vulnwire
5.9med

CVE-2018-12232

In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the sam…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.3%
percentile 94%
Public exploits
0
none known

In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.

Exploit prediction (EPSS)

6.30% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.07.1AV:N/AC:M/Au:N/C:N/I:N/A:C

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
Technology feeds
Linux kernel (RSS, critical only)

References

  • usn.ubuntu.com /3752-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • usn.ubuntu.com /3752-3/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • git.kernel.org /cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6d8c50dcb029872b298eea68cc6209c866fd3 · x_refsource_MISC, x_transferred
  • patchwork.ozlabs.org /patch/926519/ · x_refsource_MISC, x_transferred
  • access.redhat.com /errata/RHSA-2018:2948 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lkml.org /lkml/2018/6/5/14 · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/104453 · vdb-entry, x_refsource_BID, x_transferred
  • usn.ubuntu.com /3752-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • github.com /torvalds/linux/commit/6d8c50dcb029872b298eea68cc6209c866fd3e14 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.