K40523020 : Linux kernel vulnerability CVE-2018-16658

Security Advisory Description

An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940. (CVE-2018-16658)

Impact

A local user with Advanced Shell (bash) access on a BIG-IP system, or with local administrator access on a Traffix system, may be able to use this flaw to gain elevated privileges. In supported configurations on the BIG-IP system,bashaccess is limited to system administrators. BIG-IP appliance mode does not expose this issue, as users are not allowedbash access in this mode. On Traffix systems, only administrators have local access.