CVE-2018-1091: linux linux_kernel DEPRECATED: Unchecked Error Condition

Vulnerability summary

CVE-2018-1091 is a medium (CVSS 5.5) DEPRECATED: Unchecked Error Condition vulnerability in linux linux_kernel. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 34.7% of scored vulnerabilities.

Timeline

1. 27-03-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service.

• CWE-391DEPRECATED: Unchecked Error ConditionThis entry has been deprecated because it used ambiguous terminology and incorporated and confused multiple weaknesses. See Mapping Notes for other recommendations, and see Maintenance Notes for more detailed explanations.
• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.