UBUNTU-CVE-2018-1065
The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.
02 / AFFECTED SOFTWARE
Affected packages
12 explicit affected versions
52 explicit affected versions
74 explicit affected versions
33 explicit affected versions
15 explicit affected versions
15 explicit affected versions
34 explicit affected versions
13 explicit affected versions
47 explicit affected versions
44 explicit affected versions
26 explicit affected versions
51 explicit affected versions
6 explicit affected versions
12 explicit affected versions
1 explicit affected versions
1 explicit affected versions
23 explicit affected versions
1 explicit affected versions
3 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.
05 / REFERENCES
Further evidence
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8
- http://lists.openwall.net/netdev/2018/01/27/46
- http://patchwork.ozlabs.org/patch/870355/
- https://bugzilla.redhat.com/show_bug.cgi?id=1547824
- https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8
- https://ubuntu.com/security/CVE-2018-1065
- https://ubuntu.com/security/notices/USN-3654-1
- https://ubuntu.com/security/notices/USN-3654-2
- https://ubuntu.com/security/notices/USN-3656-1
- https://www.cve.org/CVERecord?id=CVE-2018-1065