CVE-2018-11412: canonical ubuntu_linux Use After Free

CVSS: 5.9v3.0MediumModified

AliasesUBUNTU-CVE-2018-11412DEBIAN-CVE-2018-11412

Published 24-05-2018Last modified 05-08-2024

Vulnerability summary

CVE-2018-11412 is a medium (CVSS 5.9) Use After Free vulnerability in canonical ubuntu_linux. EPSS estimates a 15.84% chance of exploitation in the next 30 days, higher than 96.8% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

37/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.9/10

010

Medium · v3.0 (NVD)

EPSS score

15.84%

0%100%

Medium · -0.31 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 7 · Related 3

MGASA-2018-0324 MGASA-2018-0340 MGASA-2018-0341 RHSA-2019:0525 USN-3752-1 USN-3752-2+1 more

Timeline

24-05-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.05.9v2.04.3

EPSS trend

Probability

15.84%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

-0.31 pp

From 16.15% on 18-09-2026

18-09-202618-10-2026

EPSS score

15.84%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (bugs.chromium.org)
Maturity: unknown
referenceUnverified
Exploit Reference (bugzilla.kernel.org)
Maturity: unknown
exploit-databasedoslinuxUnverified
Linux Kernel < 4.16.11 - 'ext4_read_inline_data()' Memory Corruption
Maturity: poc

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Ubuntu8 products

linux< 4.15.0-33.36
linux-aws< 4.15.0-1020.20
linux-azure< 4.15.0-1022.22~16.04.1 | < 4.15.0-1022.23
linux-gcp< 4.15.0-1018.19~16.04.2 | < 4.15.0-1018.19
linux-hwe< 4.15.0-33.36~16.04.1

Show all 8

Canonical1 product

ubuntu_linuxEOL16.04 | 18.04

Debian1 product

linux< 4.17.3-1

Linux1 product

linux_kernel≥ 4.13, ≤ 4.16.11

4 vendors · 11 products

References

14 links

usn.ubuntu.com/3752-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.securityfocus.com/bid/104291VDB EntryX Refsource BIDThird Party Advisory
bugs.chromium.org/p/project-zero/issues/detail?id=1580X Refsource MISCExploitThird Party AdvisoryREPORT
usn.ubuntu.com/3752-3/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
bugzilla.kernel.org/show_bug.cgi?id=199803X Refsource MISCExploitIssue TrackingThird Party AdvisoryREPORT
www.exploit-db.com/exploits/44832/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2019:0525Vendor AdvisoryX Refsource REDHATThird Party Advisory
usn.ubuntu.com/3752-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
ubuntu.com/security/CVE-2018-11412REPORT
ubuntu.com/security/notices/USN-3752-1Advisory

Show all 14 references

ubuntu.com/security/notices/USN-3752-2Advisory
ubuntu.com/security/notices/USN-3752-3Advisory
www.cve.org/CVERecord?id=CVE-2018-11412REPORT
security-tracker.debian.org/tracker/CVE-2018-11412Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities