CVE-2018-1000199

Impact:
Important
Public Date:
2018-05-01
CWE:
CWE-460
Bugzilla:
1568477: CVE-2018-1000199 kernel: ptrace() incorrect error handling leads to corruption and DoS
An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.

Find out more about CVE-2018-1000199 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

This issue affects the version of the kernel package as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2 may address this issue.

CVSS v3 metrics

CVSS3 Base Score 7.8
CVSS3 Base Metrics CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity Impact High
Availability Impact High

Red Hat Security Errata

Platform Errata Release Date
Red Hat MRG Grid for RHEL 6 Server v.2 (kernel-rt) RHSA-2018:1354 2018-05-08
Red Hat Enterprise Linux 7 (kernel-alt) RHSA-2018:1374 2018-05-14
Red Hat Enterprise Linux for Real Time for NFV (v. 7) (kernel-rt) RHSA-2018:1355 2018-05-08
Red Hat Enterprise Linux Extended Update Support 7.4 (kernel) RHSA-2018:1345 2018-05-08
Red Hat Enterprise Linux Server TUS (v. 7.2) (kernel) RHSA-2018:1347 2018-05-08
Red Hat Enterprise Linux Server Update Services for SAP Solutions 7.2 (kernel) RHSA-2018:1347 2018-05-08
Red Hat Enterprise Linux Extended Update Support 7.3 (kernel) RHSA-2018:1348 2018-05-08
Red Hat Enterprise Linux 7 (kernel) RHSA-2018:1318 2018-05-08
Red Hat Enterprise Linux Advanced Update Support 7.2 (kernel) RHSA-2018:1347 2018-05-08

Affected Packages State

Platform Package State
Red Hat Enterprise MRG 2 realtime-kernel Affected
Red Hat Enterprise Linux 6 kernel Not affected
Red Hat Enterprise Linux 5 kernel Not affected

Acknowledgements

Red Hat would like to thank Andy Lutomirski for reporting this issue.

Mitigation

To mitigate this issue:
1) Save the following script in a 'CVE-2018-1000199.stp' file.
---
probe kernel.function("ptrace_set_debugreg") {
        if ($n < 4)
            $n = 4; /* set invalid debug register #, returns -EIO */
}
probe begin {
        printk(0, "CVE-2018-1000199 mitigation loaded")
}
probe end {
        printk(0, "CVE-2018-1000199 mitigation unloaded")
}
---
2) Install systemtap package and its dependencies
     # yum install -y systemtap systemtap-runtime
     # yum install -y kernel-devel kernel-debuginfo kernel-debuginfo-common

3) Build the mitigation kernel module as root.
    # stap -r `uname -r` -m cve_2018_1000199.ko -g CVE-2018-1000199.stp -p4

4) Load the mitigation module as root
    # staprun -L cve_2018_1000199.ko

Last Modified
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.