Description
The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a Linux kernel since 3.13 up to 4.14 (not including)
Linux kernel since 3.13 up to 4.14 (not including)affected
References
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.11 ↗
- https://github.com/torvalds/linux/commit/ea6789980fdaa610d7eb63602c746bf6ec70cd2b ↗
- http://www.securityfocus.com/bid/101678 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1501215 ↗
- https://access.redhat.com/errata/RHSA-2018:0151 ↗
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea6789980fdaa610d7eb63602c746bf6ec70cd2b ↗
- https://usn.ubuntu.com/3698-1/ ↗
- https://usn.ubuntu.com/3698-2/ ↗