CVE-2018-16871
Published: 30 July 2019
A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
linux
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-46.49)
|
| cosmic |
Released
(4.18.0-14.15)
|
|
| disco |
Not vulnerable
(4.19.0-12.13)
|
|
| trusty |
Not vulnerable
(3.11.0-12.19)
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Not vulnerable
(4.2.0-16.19)
|
|
|
Patches:
Introduced by
ffa0160a103917defd5d9c097ae0455a59166e03
|
||
|
linux-aws
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1033.35)
|
| cosmic |
Released
(4.18.0-1008.10)
|
|
| disco |
Not vulnerable
(4.18.0-1008.10)
|
|
| trusty |
Not vulnerable
(4.4.0-1002.2)
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Not vulnerable
(4.4.0-1001.10)
|
|
|
linux-aws-hwe
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Released
(4.15.0-1033.35~16.04.1)
|
|
|
linux-azure
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.18.0-1011.11~18.04.1)
|
| cosmic |
Released
(4.18.0-1008.8)
|
|
| disco |
Not vulnerable
(4.18.0-1008.8)
|
|
| trusty |
Released
(4.15.0-1040.44~14.04.1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Released
(4.15.0-1040.44)
|
|
|
linux-azure-edge
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.18.0-1011.11~18.04.1)
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Released
(4.15.0-1040.44)
|
|
|
linux-euclid
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Ignored
(end of life, was needs-triage)
|
|
|
linux-flo
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
(trusty was ignored [abandoned])
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Ignored
(abandoned)
|
|
|
linux-gcp
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1028.29)
|
| cosmic |
Released
(4.18.0-1006.7)
|
|
| disco |
Not vulnerable
(4.18.0-1006.7)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Released
(4.15.0-1028.29~16.04.1)
|
|
|
linux-gcp-edge
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.18.0-1006.7~18.04.1)
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Does not exist
|
|
|
linux-gke
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Ignored
(end of standard support)
|
|
|
linux-gke-4.15
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(4.15.0-1030.32)
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Does not exist
|
|
|
linux-goldfish
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
(trusty was ignored [abandoned])
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Ignored
(end of life)
|
|
|
linux-grouper
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
(trusty was ignored [abandoned])
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Does not exist
|
|
|
linux-hwe
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.18.0-14.15~18.04.1)
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Released
(4.15.0-46.49~16.04.1)
|
|
|
linux-hwe-edge
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.0.0-15.16~18.04.1)
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Released
(4.15.0-46.49~16.04.1)
|
|
|
linux-kvm
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1030.30)
|
| cosmic |
Released
(4.18.0-1007.7)
|
|
| disco |
Not vulnerable
(4.18.0-1007.7)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Not vulnerable
(4.4.0-1004.9)
|
|
|
linux-lts-trusty
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Does not exist
|
|
|
linux-lts-utopic
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Ignored
(end of life, was ignored)
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Does not exist
|
|
|
linux-lts-vivid
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Ignored
(end of life, was ignored)
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Does not exist
|
|
|
linux-lts-wily
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Ignored
(end of life, was ignored)
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Does not exist
|
|
|
linux-lts-xenial
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Not vulnerable
(4.4.0-13.29~14.04.1)
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Does not exist
|
|
|
linux-maguro
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
(trusty was ignored [abandoned])
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Does not exist
|
|
|
linux-mako
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
(trusty was ignored [abandoned])
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Ignored
(abandoned)
|
|
|
linux-manta
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
(trusty was ignored [abandoned])
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Does not exist
|
|
|
linux-oem
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1034.39)
|
| cosmic |
Released
(4.15.0-1034.39)
|
|
| disco |
Not vulnerable
(4.15.0-1034.39)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
linux-oracle
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1009.11)
|
| cosmic |
Released
(4.15.0-1009.11)
|
|
| disco |
Not vulnerable
(4.15.0-1009.11)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Released
(4.15.0-1009.11~16.04.1)
|
|
|
linux-raspi2
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1032.34)
|
| cosmic |
Released
(4.18.0-1009.11)
|
|
| disco |
Not vulnerable
(4.18.0-1009.11)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Not vulnerable
(4.2.0-1013.19)
|
|
|
linux-snapdragon
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(4.4.0-1077.82)
|
| cosmic |
Does not exist
|
|
| disco |
Not vulnerable
(5.0.0-1010.10)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(4.20~rc3)
|
|
| xenial |
Not vulnerable
(4.4.0-1012.12)
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |