CVE-2018-1084: canonical ubuntu_linux Integer Overflow or Wraparound
CVSS: 7.5v3.0HighModified
AliasesMGASA-2018-0275SUSE-SU-2018:1121-1SUSE-SU-2018:1130-1RHSA-2018:1169UBUNTU-CVE-2018-1084USN-4000-1DEBIAN-CVE-2018-1084DSA-4174-1openSUSE-SU-2024:10695-1
Published 12-04-2018Last modified 05-08-2024
Vulnerability summary
CVE-2018-1084 is a high (CVSS 7.5) Integer Overflow or Wraparound vulnerability in canonical ubuntu_linux. EPSS estimates a 3.11% chance of exploitation in the next 30 days, higher than 87.6% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.0 (CVE.org)EPSS score
3.11%
0%100%
Low · -0.06 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 12-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.
CVSS metrics
8 scores · 5 sources · 3 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources4 sources · 7.5–9.8
- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
3.11%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
-0.06 pp
From 3.17% on 18-09-2026
18-09-202618-10-2026
EPSS score3.11%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat7 products
- enterprise_linux_server7.0
- corosync< 0:2.4.3-2.el7_5.1
- corosync-debuginfo< 0:2.4.3-2.el7_5.1
- corosync-qdevice< 0:2.4.3-2.el7_5.1
- corosync-qnetd< 0:2.4.3-2.el7_5.1
Suse3 products
- corosync&distro=SUSE Linux Enterprise High Availability Extension 12 SP2< 2.3.5-6.23.1
- corosync&distro=SUSE Linux Enterprise High Availability Extension 12 SP3< 2.3.6-9.13.1
- corosync&distro=SUSE Linux Enterprise Software Development Kit 12 SP3< 2.3.6-9.13.1
Debian2 products
- corosync< 2.4.4-1 | < 2.4.2-3+deb9u1
- debian_linuxEOL9.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04
Corosync1 product
- corosync≥ 2.3.0, < 2.4.4
Mageia1 product
- corosync< 2.3.5-2.1.mga6
Opensuse1 product
- corosync&distro=openSUSE Tumbleweed< 2.4.5+git70.64010f57-1.2
Ubuntu1 product
- corosync< 2.3.5-3ubuntu2.3 | < 2.4.3-0ubuntu1.1
Unspecified1 product
- corosynccorosync 2.4.4
9 vendors · 18 products
References
27 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1084X Refsource MISCIssue TrackingPatchThird Party Advisory
- access.redhat.com/errata/RHSA-2018:1169Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
