UBUNTU-CVE-2018-20961

Description

In the Linux kernel before 4.16.4, a double free vulnerability in the f_midi_set_alt function of drivers/usb/gadget/function/f_midi.c in the f_midi driver may allow attackers to cause a denial of service or possibly have unspecified other impact.

CVSS Metrics

• v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Systems

• ubuntu•linux

  < 4.4.0-165.193 | < 4.15.0-24.26

• ubuntu•linux-aws

  < 4.4.0-1055.59

• ubuntu•linux-azure-fde

  all

• ubuntu•linux-fips

  < 4.4.0-1022.27 | all

• ubuntu•linux-gcp

  < 4.15.0-1014.14~16.04.1 | < 4.15.0-1010.10

• ubuntu•linux-gke

  all

• ubuntu•linux-hwe

  < 4.15.0-24.26~16.04.1

• ubuntu•linux-intel-iot-realtime

  all

• ubuntu•linux-lts-xenial

  < 4.4.0-165.193~14.04.1

• ubuntu•linux-nvidia

  all

• ubuntu•linux-oem

  < 4.15.0-1009.12

• ubuntu•linux-raspi-realtime

  all

• ubuntu•linux-raspi2

  < 4.4.0-1123.132 | < 4.15.0-1013.14 | all

• ubuntu•linux-realtime

  all

• ubuntu•linux-riscv

  all | all

• ubuntu•linux-snapdragon

  < 4.4.0-1127.135 | < 4.15.0-1053.57

References (4)

• https://ubuntu.com/security/CVE-2018-20961
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7fafcfdf6377b18b2a726ea554d6e593ba44349f
• https://ubuntu.com/security/notices/USN-4145-1
• https://www.cve.org/CVERecord?id=CVE-2018-20961