CVE-2018-10675
The do_get_mempolicy() function in mm/mempolicy.c in the Linux kernel allows local users to hit a use-after-free bug via crafted system calls and thus cause a denial of service (DoS) or possibly have unspecified other impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.
Find out more about CVE-2018-10675 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v3 metrics
| CVSS3 Base Score | 5.5 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Attack Vector | Local |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity Impact | None |
| Availability Impact | High |
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Enterprise Linux 7 (kernel) | RHSA-2018:2384 | 2018-08-14 |
| Red Hat Enterprise Linux Advanced Update Support 6.5 (kernel) | RHSA-2018:2933 | 2018-10-16 |
| Red Hat Enterprise Linux 6 (kernel) | RHSA-2018:2164 | 2018-07-10 |
| Red Hat Enterprise Linux Advanced Update Support 6.6 (kernel) | RHSA-2018:2924 | 2018-10-16 |
| Red Hat Enterprise Linux Extended Update Support 7.3 (kernel) | RHSA-2018:2785 | 2018-09-25 |
| Red Hat Enterprise Linux Advanced Update Support 6.4 (kernel) | RHSA-2018:2791 | 2018-09-25 |
| Red Hat Enterprise Linux for Real Time for NFV (v. 7) (kernel-rt) | RHSA-2018:2395 | 2018-08-14 |
| Red Hat Enterprise Linux Extended Update Support 6.7 (kernel) | RHSA-2018:2925 | 2018-10-17 |
| Red Hat Enterprise Linux Server TUS (v. 6.6) (kernel) | RHSA-2018:2924 | 2018-10-16 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise MRG 2 | realtime-kernel | Affected |
| Red Hat Enterprise Linux 7 | kernel-alt | Not affected |
| Red Hat Enterprise Linux 5 | kernel | Will not fix |