CVE-2018-10689
Publication date 3 May 2018
Last updated 25 August 2025
Ubuntu priority
Description
blktrace (aka Block IO Tracing) 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the dev_map_read function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file.
From the Ubuntu Security Team
It was discovered a buffer overflow in the blktrace utility. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| blktrace | ||
| 18.04 LTS bionic |
Fixed 1.1.0-2+deb9u1build0.18.04.1
|
|
| 16.04 LTS xenial |
Fixed 1.1.0-2+deb9u1build0.16.04.1
|
|
| 14.04 LTS trusty |
Fixed 1.0.5-1+deb8u1build0.14.04.1
|
Patch details
| Package | Patch details |
|---|---|
| blktrace |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
5.5 · Medium
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
Other references
- https://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git/commit/?id=d61ff409cb4dda31386373d706ea0cfb1aaac5b7
- https://www.spinics.net/lists/linux-btrace/msg00847.html
- http://git.kernel.dk/?p=blktrace.git;a=log;h=d61ff409cb4dda31386373d706ea0cfb1aaac5b7
- https://www.cve.org/CVERecord?id=CVE-2018-10689