What is CVE-2018-1091?

CVE-2018-1091 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10. CVE-2018-1091 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2018-1091?

CVE-2018-1091 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2018-1091?

No patch is currently available for CVE-2018-1091. Monitor the NIST NVD and your Linux distribution's security advisories for updates.

Is CVE-2018-1091 actively exploited?

CVE-2018-1091 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2018-1091

Medium

In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service.

Package Linux Kernel

Published 2018-03-27

Last modified 2024-11-21

CVSS version 3.0

Patch available

Awaiting data

CVSS 3.0 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-391

CVE-2018-1091 is classified as CWE-391

See CWE-391 on MITRE CWE for full details on this weakness type.

References

The following references provide additional information about CVE-2018-1091 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.

Openwall
http://openwall.com/lists/oss-security/2018/03/27/4

Mailing List Third Party Advisory
Red Hat
https://access.redhat.com/errata/RHSA-2018:1318
Red Hat
https://access.redhat.com/security/cve/cve-2018-1091

Third Party Advisory
Red Hat
https://bugzilla.redhat.com/show_bug.cgi?id=1558149

Issue Tracking Third Party Advisory
Kernel patch commit
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c1fa0768a8713b135848f78fd43ffc208d8ded70
Patch
Kernel patch commit
https://github.com/torvalds/linux/commit/c1fa0768a8713b135848f78fd43ffc208d8ded70
Patch
Kernel patch commit
https://marc.info/?l=linuxppc-embedded&m=150535531910494&w=2
Patch

4 patch commits total View all on NVD

Details

CVE ID CVE-2018-1091

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.0

Published 2018-03-27

Modified 2024-11-21

KEV No

Patch Awaiting data

Package linux

Frequently asked questions

What is CVE-2018-1091?

CVE-2018-1091 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . CVE-2018-1091 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2018-1091?

CVE-2018-1091 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.0). The vector string is CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2018-1091?

No patch is currently available for CVE-2018-1091. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
Is CVE-2018-1091 actively exploited?

No — CVE-2018-1091 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.