The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.
[
{
"id": "CVE-2018-18397-2181a355",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"162763651857891705297717051795681962885",
"252886811934717339831078341487762939236",
"309805251415622960061177283775140301717",
"38847988686236636808908195942635881069",
"239854422739929484586997821715980872123",
"192962523585601004029321267872298412274",
"252806154454766244371327930100815898920",
"117357893420595824141081426765656061905",
"182710314962732340766345304664397005824",
"110967525714789064919255637665598158688",
"87904863880200892183498761749370351284",
"188989513460040381571584380794163000761"
],
"threshold": 0.9
},
"target": {
"file": "fs/userfaultfd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@29ec90660d68bbdd69507c1c8b4e33aa299278b1"
},
{
"id": "CVE-2018-18397-426346e4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"334349027950764353071431832243752082976",
"239525020285109700583892111967342200383",
"221755018383466999176800762684677061539",
"153318425643414298483846319986554345928",
"330318047361916487695601363781744480881",
"221755018383466999176800762684677061539"
],
"threshold": 0.9
},
"target": {
"file": "mm/userfaultfd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@29ec90660d68bbdd69507c1c8b4e33aa299278b1"
},
{
"id": "CVE-2018-18397-6a7dd8de",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "226235449708140356725540298025928833845",
"length": 3037.0
},
"target": {
"file": "fs/userfaultfd.c",
"function": "userfaultfd_register"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@29ec90660d68bbdd69507c1c8b4e33aa299278b1"
},
{
"id": "CVE-2018-18397-8dcd4d7f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "88822189313798355102722030246757077988",
"length": 2178.0
},
"target": {
"file": "fs/userfaultfd.c",
"function": "userfaultfd_unregister"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@29ec90660d68bbdd69507c1c8b4e33aa299278b1"
}
]
[
{
"id": "CVE-2018-18397-0f994766",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "88822189313798355102722030246757077988",
"length": 2178.0
},
"target": {
"file": "fs/userfaultfd.c",
"function": "userfaultfd_unregister"
},
"source": "https://github.com/torvalds/linux/commit/29ec90660d68bbdd69507c1c8b4e33aa299278b1"
},
{
"id": "CVE-2018-18397-10186e0a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"162763651857891705297717051795681962885",
"252886811934717339831078341487762939236",
"309805251415622960061177283775140301717",
"38847988686236636808908195942635881069",
"239854422739929484586997821715980872123",
"192962523585601004029321267872298412274",
"252806154454766244371327930100815898920",
"117357893420595824141081426765656061905",
"182710314962732340766345304664397005824",
"110967525714789064919255637665598158688",
"87904863880200892183498761749370351284",
"188989513460040381571584380794163000761"
],
"threshold": 0.9
},
"target": {
"file": "fs/userfaultfd.c"
},
"source": "https://github.com/torvalds/linux/commit/29ec90660d68bbdd69507c1c8b4e33aa299278b1"
},
{
"id": "CVE-2018-18397-11370444",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"334349027950764353071431832243752082976",
"239525020285109700583892111967342200383",
"221755018383466999176800762684677061539",
"153318425643414298483846319986554345928",
"330318047361916487695601363781744480881",
"221755018383466999176800762684677061539"
],
"threshold": 0.9
},
"target": {
"file": "mm/userfaultfd.c"
},
"source": "https://github.com/torvalds/linux/commit/29ec90660d68bbdd69507c1c8b4e33aa299278b1"
},
{
"id": "CVE-2018-18397-623cf3a0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "226235449708140356725540298025928833845",
"length": 3037.0
},
"target": {
"file": "fs/userfaultfd.c",
"function": "userfaultfd_register"
},
"source": "https://github.com/torvalds/linux/commit/29ec90660d68bbdd69507c1c8b4e33aa299278b1"
}
]