CVE-2018-10840

Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image.

Affected

kernel · heap-based buffer overflow in fs/ext4/xattr.c

CVSS v3.1 NVD

6.6 MEDIUMCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0 REDHAT

5.2 MEDIUMCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.67% chance of exploitation in the next 30 days, 51st percentile

Published

2018-07-16

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10840

Security advisories

• http://www.securityfocus.com/bid/104858
• https://access.redhat.com/errata/RHSA-2019:0162
• https://usn.ubuntu.com/3752-1
• https://usn.ubuntu.com/3752-2
• https://usn.ubuntu.com/3752-3

References

• CVE Record
• NVD entry