CVE-2018-146337.0HighCWE-121

CVE-2018-14633: The Linux Foundation kernel vulnerability

The Linux Foundation · kernel

Vendor fix available · Affected: The Linux Foundation kernel · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

8.7%probability of exploitation in the next 30 days

95th percentile

050100

Higher than 95% of scored CVEs

7.0HighCVSS 3.0

LowMediumHighCrit.

DescriptionCVE.org

A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

The Linux Foundation · kernel4.18.x, 4.14.x, 3.10.x

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Stack-based Buffer Overflow · Memory Corruption
Vendor: The Linux Foundation
Published: September 2018
Band: Possible (1 to 10%), September 2018

CoverageNo articles yet

No CyberSIXT article names CVE-2018-14633 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.

References

6 more references are in the CVE record.