UBUNTU-CVE-2018-12896
An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically makes the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls.
02 / AFFECTED SOFTWARE
Affected packages
55 explicit affected versions
14 explicit affected versions
6 explicit affected versions
61 explicit affected versions
17 explicit affected versions
22 explicit affected versions
1 explicit affected versions
8 explicit affected versions
12 explicit affected versions
7 explicit affected versions
1 explicit affected versions
23 explicit affected versions
142 explicit affected versions
17 explicit affected versions
23 explicit affected versions
63 explicit affected versions
57 explicit affected versions
19 explicit affected versions
23 explicit affected versions
24 explicit affected versions
7 explicit affected versions
85 explicit affected versions
5 explicit affected versions
51 explicit affected versions
28 explicit affected versions
7 explicit affected versions
44 explicit affected versions
19 explicit affected versions
26 explicit affected versions
16 explicit affected versions
44 explicit affected versions
3 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically makes the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls.
05 / REFERENCES
Further evidence
- https://bugzilla.kernel.org/show_bug.cgi?id=200189
- https://github.com/lcytxw/bug_repro/tree/master/bug_200189
- https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76
- https://ubuntu.com/security/CVE-2018-12896
- https://ubuntu.com/security/notices/USN-3847-1
- https://ubuntu.com/security/notices/USN-3847-2
- https://ubuntu.com/security/notices/USN-3847-3
- https://ubuntu.com/security/notices/USN-3848-1
- https://ubuntu.com/security/notices/USN-3848-2
- https://ubuntu.com/security/notices/USN-3849-1
- https://ubuntu.com/security/notices/USN-3849-2
- https://www.cve.org/CVERecord?id=CVE-2018-12896