CVE-2018-18710

Published: 29 October 2018

An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658.

From the Ubuntu security team

It was discovered that an integer overflow vulnerability existed in the CDROM driver of the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory).

Priority

CVSS 3 base score: 5.5

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-43.46)
	cosmic	Released (4.18.0-13.14)
	precise	Ignored (was needs-triage ESM criteria)
	trusty	Released (3.13.0-164.214)
	upstream	Released (4.20~rc1)
	xenial	Released (4.4.0-141.167)
linux-aws Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-1031.33)
	cosmic	Released (4.18.0-1007.9)
	precise	Does not exist
	trusty	Released (4.4.0-1037.40)
	upstream	Released (4.20~rc1)
	xenial	Released (4.4.0-1074.84)
linux-aws-hwe Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Released (4.15.0-1031.33~16.04.1)
linux-azure Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-1036.38)
	cosmic	Released (4.18.0-1007.7)
	precise	Does not exist
	trusty	Released (4.15.0-1036.38~14.04.2)
	upstream	Released (4.20~rc1)
	xenial	Released (4.15.0-1036.38~16.04.1)
linux-azure-edge Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-1036.38)
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Released (4.15.0-1036.38~16.04.1)
linux-euclid Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Ignored (was needs-triage ESM criteria)
linux-flo Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.20~rc1)
	xenial	Ignored (abandoned)
linux-gcp Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-1026.27)
	cosmic	Released (4.18.0-1005.6)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Released (4.15.0-1026.27~16.04.1)
linux-gcp-edge Launchpad, Ubuntu, Debian	bionic	Released (4.18.0-1005.6~18.04.1)
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Does not exist
linux-gke Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Ignored (end-of-life)
linux-goldfish Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.20~rc1)
	xenial	Ignored (end-of-life)
linux-grouper Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.20~rc1)
	xenial	Does not exist
linux-hwe Launchpad, Ubuntu, Debian	bionic	Not vulnerable (4.18.0-13.14~18.04.1)
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Released (4.15.0-43.46~16.04.1)
linux-hwe-edge Launchpad, Ubuntu, Debian	bionic	Not vulnerable (5.0.0-8.9~18.04.1)
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Released (4.15.0-43.46~16.04.1)
linux-kvm Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-1028.28)
	cosmic	Released (4.18.0-1006.6)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Released (4.4.0-1039.45)
linux-lts-trusty Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Released (3.13.0-164.214~precise1)
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Does not exist
linux-lts-utopic Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [out of standard support])
	upstream	Released (4.20~rc1)
	xenial	Does not exist
linux-lts-vivid Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [out of standard support])
	upstream	Released (4.20~rc1)
	xenial	Does not exist
linux-lts-wily Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [out of standard support])
	upstream	Released (4.20~rc1)
	xenial	Does not exist
linux-lts-xenial Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Released (4.4.0-141.167~14.04.1)
	upstream	Released (4.20~rc1)
	xenial	Does not exist
linux-maguro Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.20~rc1)
	xenial	Does not exist
linux-mako Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.20~rc1)
	xenial	Ignored (abandoned)
linux-manta Launchpad, Ubuntu, Debian	bionic	Does not exist
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.20~rc1)
	xenial	Does not exist
linux-oem Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-1030.35)
	cosmic	Released (4.15.0-1030.35)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Ignored (was needs-triage now end-of-life)
linux-oracle Launchpad, Ubuntu, Debian	bionic	Not vulnerable (4.15.0-1007.9)
	cosmic	Not vulnerable
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Not vulnerable (4.15.0-1007.9~16.04.1)
linux-raspi2 Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-1030.32)
	cosmic	Released (4.18.0-1008.10)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Released (4.4.0-1102.110)
linux-snapdragon Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	cosmic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.20~rc1)
	xenial	Released (4.4.0-1106.111)

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›