UBUNTU-CVE-2018-12232
In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.
02 / AFFECTED SOFTWARE
Affected packages
20 explicit affected versions
18 explicit affected versions
38 explicit affected versions
16 explicit affected versions
11 explicit affected versions
11 explicit affected versions
10 explicit affected versions
11 explicit affected versions
8 explicit affected versions
12 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.
05 / REFERENCES
Further evidence
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6d8c50dcb029872b298eea68cc6209c866fd3e14
- https://github.com/torvalds/linux/commit/6d8c50dcb029872b298eea68cc6209c866fd3e14
- https://lkml.org/lkml/2018/6/5/14
- https://patchwork.ozlabs.org/patch/926519/
- https://ubuntu.com/security/CVE-2018-12232
- https://ubuntu.com/security/notices/USN-3752-1
- https://ubuntu.com/security/notices/USN-3752-2
- https://ubuntu.com/security/notices/USN-3752-3
- https://www.cve.org/CVERecord?id=CVE-2018-12232