{"schemaVersion":3,"id":"USN-3753-2","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"linux-lts-xenial, linux-aws vulnerabilities\n\nUSN-3753-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nIt was discovered that the generic SCSI driver in the Linux kernel did not\nproperly enforce permissions on kernel memory access. A local attacker\ncould use this to expose sensitive information or possibly elevate\nprivileges. (CVE-2017-13168)\n\nWen Xu discovered that a use-after-free vulnerability existed in the ext4\nfilesystem implementation in the Linux kernel. An attacker could use this\nto construct a malicious ext4 image that, when mounted, could cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2018-10876, CVE-2018-10879)\n\nWen Xu discovered that a buffer overflow existed in the ext4 filesystem\nimplementation in the Linux kernel. An attacker could use this to construct\na malicious ext4 image that, when mounted, could cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2018-10877)\n\nWen Xu discovered that an out-of-bounds write vulnerability existed in the\next4 filesystem implementation in the Linux kernel. An attacker could use\nthis to construct a malicious ext4 image that, when mounted, could cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2018-10878, CVE-2018-10882)\n\nWen Xu discovered that the ext4 filesystem implementation in the Linux\nkernel did not properly keep meta-data information consistent in some\nsituations. An attacker could use this to construct a malicious ext4 image\nthat, when mounted, could cause a denial of service (system crash).\n(CVE-2018-10881)\n\nShankara Pailoor discovered that the JFS filesystem implementation in the\nLinux kernel contained a buffer overflow when handling extended attributes.\nA local attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2018-12233)\n\nWen Xu discovered that the XFS filesystem implementation in the Linux\nkernel did not properly handle an error condition with a corrupted xfs\nimage. An attacker could use this to construct a malicious xfs image that,\nwhen mounted, could cause a denial of service (system crash).\n(CVE-2018-13094)\n\nIt was discovered that the Linux kernel did not properly handle setgid file\ncreation when performed by a non-member of the group. A local attacker\ncould use this to gain elevated privileges. (CVE-2018-13405)\n\nSilvio Cesare discovered that the generic VESA frame buffer driver in the\nLinux kernel contained an integer overflow. A local attacker could use this\nto cause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2018-13406)","dates":{"published":"2018-08-24T00:46:51.000Z","modified":"2026-02-10T04:41:25.000Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"linux-aws","name":"linux-aws","label":"linux-aws","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/linux-aws","purlType":"deb","versions":[{"text":"< 4.4.0-1028.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.4.0-1028.31","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"linux-lts-xenial","name":"linux-lts-xenial","label":"linux-lts-xenial","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/linux-lts-xenial","purlType":"deb","versions":[{"text":"< 4.4.0-134.160~14.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.4.0-134.160~14.04.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-3753-2","label":"ubuntu.com/security/notices/USN-3753-2","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-13168","label":"ubuntu.com/security/CVE-2017-13168","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-10876","label":"ubuntu.com/security/CVE-2018-10876","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-10877","label":"ubuntu.com/security/CVE-2018-10877","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-10878","label":"ubuntu.com/security/CVE-2018-10878","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-10879","label":"ubuntu.com/security/CVE-2018-10879","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-10881","label":"ubuntu.com/security/CVE-2018-10881","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-10882","label":"ubuntu.com/security/CVE-2018-10882","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-12233","label":"ubuntu.com/security/CVE-2018-12233","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-13094","label":"ubuntu.com/security/CVE-2018-13094","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-13405","label":"ubuntu.com/security/CVE-2018-13405","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-13406","label":"ubuntu.com/security/CVE-2018-13406","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2017-13168","CVE-2018-10876","CVE-2018-10877","CVE-2018-10878","CVE-2018-10879","CVE-2018-10881","CVE-2018-10882","CVE-2018-12233","CVE-2018-13094","CVE-2018-13405","CVE-2018-13406"],"downstream":[],"duplicates":[],"related":["CVE-2017-13168","CVE-2018-10876","CVE-2018-10877","CVE-2018-10878","CVE-2018-10879","CVE-2018-10881","CVE-2018-10882","CVE-2018-12233","CVE-2018-13094","CVE-2018-13405","CVE-2018-13406"]},"timeline":[{"kind":"published","date":"2018-08-24T00:46:51.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-10T04:41:25.000Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T15:00:26.477Z","stale":false,"partial":false}}