An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via ‘modify_user_hw_breakpoint’ routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.

Mitigation

To mitigate this issue:

1. Save the following script in a 'CVE-2018-1000199.stp' file.
   -–
   probe kernel.function("ptrace_set_debugreg") {
   if ($n < 4)
   $n = 4; /* set invalid debug register #, returns -EIO */
   }
   probe begin {
   printk(0, "CVE-2018-1000199 mitigation loaded")
   }
   probe end {
   printk(0, "CVE-2018-1000199 mitigation unloaded")
   }
   -–

2. Install systemtap package and its dependencies

   yum install -y systemtap systemtap-runtime

   yum install -y kernel-devel kernel-debuginfo kernel-debuginfo-common

3. Build the mitigation kernel module as root.

   stap -r uname -r -m cve_2018_1000199.ko -g CVE-2018-1000199.stp -p4

4. Load the mitigation module as root

   staprun -L cve_2018_1000199.ko