Home

CVE-2018-19854

Description

An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs. NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attacker does not need a capability (however, the system must have the CONFIG_CRYPTO_USER kconfig option).

Risk Information

Base Score
4.7
MODERATE
Vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.053

Associated Vulnerability

VulnerabilityOS Platform
Linux hardware enablement (HWE) kernel (USN-3872-1) linux-image-4.18.0-14-generic_4.18.0-14.15~18.04.1_i386.debLinux
Linux hardware enablement (HWE) kernel (USN-3872-1) linux-image-4.18.0-14-generic_4.18.0-14.15~18.04.1_amd64.debLinux
Linux hardware enablement (HWE) kernel (USN-3872-1) linux-image-4.18.0-14-lowlatency_4.18.0-14.15~18.04.1_i386.debLinux
Linux hardware enablement (HWE) kernel (USN-3872-1) linux-image-4.18.0-14-lowlatency_4.18.0-14.15~18.04.1_amd64.debLinux
Linux kernel (USN-3878-1) linux-image-gcp_4.18.0.1006.6_amd64.debLinux
Linux kernel (USN-3878-1) linux-image-gke_4.18.0.1006.6_amd64.debLinux
Linux kernel (USN-3878-1) linux-image-kvm_4.18.0.1007.7_amd64.debLinux
Linux kernel (USN-3878-1) linux-image-4.18.0-1006-gcp_4.18.0-1006.7_amd64.debLinux
Linux kernel (USN-3878-1) linux-image-4.18.0-1007-kvm_4.18.0-1007.7_amd64.debLinux
Linux kernel (USN-3878-1) linux-image-4.18.0-1008-aws_4.18.0-1008.10_amd64.debLinux
Linux kernel (USN-3878-1) linux-image-4.18.0-14-generic_4.18.0-14.15_i386.debLinux
Linux kernel (USN-3878-1) linux-image-4.18.0-14-generic_4.18.0-14.15_amd64.debLinux
Linux kernel (USN-3878-1) linux-image-4.18.0-14-lowlatency_4.18.0-14.15_i386.debLinux
Linux kernel (USN-3878-1) linux-image-4.18.0-14-lowlatency_4.18.0-14.15_amd64.debLinux
Linux kernel for Microsoft Azure Cloud systems (USN-3878-2) linux-image-4.18.0-1008-azure_4.18.0-1008.8_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-gcp_4.15.0.1028.30_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-gke_4.15.0.1028.30_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-kvm_4.15.0.1030.30_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-oem_4.15.0.1034.39_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-oracle_4.15.0.1009.12_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-generic_4.15.0.46.48_i386.debLinux
Linux kernel (USN-3901-1) linux-image-generic_4.15.0.46.48_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-lowlatency_4.15.0.46.48_i386.debLinux
Linux kernel (USN-3901-1) linux-image-lowlatency_4.15.0.46.48_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-4.15.0-1028-gcp_4.15.0-1028.29_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-4.15.0-1030-kvm_4.15.0-1030.30_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-4.15.0-1033-aws_4.15.0-1033.35_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-4.15.0-1034-oem_4.15.0-1034.39_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-4.15.0-46-generic_4.15.0-46.49_i386.debLinux
Linux kernel (USN-3901-1) linux-image-4.15.0-46-generic_4.15.0-46.49_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-4.15.0-1009-oracle_4.15.0-1009.11_amd64.debLinux
Linux kernel (USN-3901-1) linux-image-4.15.0-46-lowlatency_4.15.0-46.49_i386.debLinux
Linux kernel (USN-3901-1) linux-image-4.15.0-46-lowlatency_4.15.0-46.49_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-gcp_4.15.0.1028.42_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-gke_4.15.0.1028.42_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-oem_4.15.0.46.67_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-azure_4.15.0.1040.27_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-azure_4.15.0.1040.44_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-oracle_4.15.0.1009.3_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-aws-hwe_4.15.0.1033.34_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-4.15.0-1028-gcp_4.15.0-1028.29~16.04.1_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-4.15.0-1033-aws_4.15.0-1033.35~16.04.1_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-4.15.0-1040-azure_4.15.0-1040.44_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-4.15.0-1040-azure_4.15.0-1040.44~14.04.1_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-4.15.0-46-generic_4.15.0-46.49~16.04.1_i386.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-4.15.0-46-generic_4.15.0-46.49~16.04.1_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-generic-hwe-16.04_4.15.0.46.67_i386.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-generic-hwe-16.04_4.15.0.46.67_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-4.15.0-1009-oracle_4.15.0-1009.11~16.04.1_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-4.15.0-46-lowlatency_4.15.0-46.49~16.04.1_i386.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-4.15.0-46-lowlatency_4.15.0-46.49~16.04.1_amd64.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-lowlatency-hwe-16.04_4.15.0.46.67_i386.debLinux
Linux kernel for Amazon Web Services (AWS-HWE) systems (USN-3901-2) linux-image-lowlatency-hwe-16.04_4.15.0.46.67_amd64.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234