7.1 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
0.007 Low
EPSS
Percentile
79.9%
Issue Overview:
Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service:
An error in the “_sctp_make_chunk()” function (net/sctp/sm_make_chunk.c) when handling SCTP, packet length can be exploited by a malicious local user to cause a kernel crash and a DoS. (CVE-2018-5803)
Mishandling mutex within libsas allowing local Denial of Service
The Serial Attached SCSI (SAS) implementation in the Linux kernel mishandles a mutex within libsas. This allows local users to cause a denial of service (deadlock) by triggering certain error-handling code. (CVE-2017-18232)
A flaw was found in the Linux kernel’s client-side implementation of the cifs protocol. This flaw allows an attacker controlling the server to kernel panic a client which has the CIFS server mounted.(CVE-2018-1066)
Affected Packages:
kernel
Issue Correction:
Run yum update kernel to update your system.
New Packages:
i686:
kernel-debuginfo-common-i686-4.9.93-41.60.amzn1.i686
kernel-4.9.93-41.60.amzn1.i686
kernel-tools-devel-4.9.93-41.60.amzn1.i686
perf-4.9.93-41.60.amzn1.i686
kernel-debuginfo-4.9.93-41.60.amzn1.i686
kernel-tools-debuginfo-4.9.93-41.60.amzn1.i686
kernel-devel-4.9.93-41.60.amzn1.i686
kernel-headers-4.9.93-41.60.amzn1.i686
kernel-tools-4.9.93-41.60.amzn1.i686
perf-debuginfo-4.9.93-41.60.amzn1.i686
noarch:
kernel-doc-4.9.93-41.60.amzn1.noarch
src:
kernel-4.9.93-41.60.amzn1.src
x86_64:
perf-4.9.93-41.60.amzn1.x86_64
kernel-tools-debuginfo-4.9.93-41.60.amzn1.x86_64
perf-debuginfo-4.9.93-41.60.amzn1.x86_64
kernel-tools-4.9.93-41.60.amzn1.x86_64
kernel-4.9.93-41.60.amzn1.x86_64
kernel-devel-4.9.93-41.60.amzn1.x86_64
kernel-tools-devel-4.9.93-41.60.amzn1.x86_64
kernel-headers-4.9.93-41.60.amzn1.x86_64
kernel-debuginfo-4.9.93-41.60.amzn1.x86_64
kernel-debuginfo-common-x86_64-4.9.93-41.60.amzn1.x86_64
Red Hat: CVE-2017-18232, CVE-2018-1066, CVE-2018-5803
Mitre: CVE-2017-18232, CVE-2018-1066, CVE-2018-5803
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Amazon Linux | 1 | i686 | kernel-debuginfo-common-i686 | < 4.9.93-41.60.amzn1 | kernel-debuginfo-common-i686-4.9.93-41.60.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | kernel | < 4.9.93-41.60.amzn1 | kernel-4.9.93-41.60.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | kernel-tools-devel | < 4.9.93-41.60.amzn1 | kernel-tools-devel-4.9.93-41.60.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | perf | < 4.9.93-41.60.amzn1 | perf-4.9.93-41.60.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | kernel-debuginfo | < 4.9.93-41.60.amzn1 | kernel-debuginfo-4.9.93-41.60.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | kernel-tools-debuginfo | < 4.9.93-41.60.amzn1 | kernel-tools-debuginfo-4.9.93-41.60.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | kernel-devel | < 4.9.93-41.60.amzn1 | kernel-devel-4.9.93-41.60.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | kernel-headers | < 4.9.93-41.60.amzn1 | kernel-headers-4.9.93-41.60.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | kernel-tools | < 4.9.93-41.60.amzn1 | kernel-tools-4.9.93-41.60.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | perf-debuginfo | < 4.9.93-41.60.amzn1 | perf-debuginfo-4.9.93-41.60.amzn1.i686.rpm |
7.1 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
0.007 Low
EPSS
Percentile
79.9%