CVE-2018-7273

In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function show_floppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel code and data and bypass kernel security protections such as KASLR.

CVSS v3.0

5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.9 MEDIUMAV:L/AC:L/Au:N/C:C/I:N/A:N

EPSS

1.76% chance of exploitation in the next 30 days, 76th percentile

Published

2018-02-21

Updated

2024-08-05

Proof-of-concept exploits (1)

• jedai47/CVE-2018-72730★ · 2023-04-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/44325

References

• CVE Record
• NVD entry

Related

• CVE-2017-16994
• CVE-2018-17182
• CVE-2018-7264
• CVE-2018-7282
• CVE-2018-7254
• CVE-2018-7284