VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel.
Advisory: CVE-2018-5332
Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2018-5332
CVSS severity score: 7.2/10.0
Description:
In the Linux kernel through 4.14.13, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).
This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.
Comment 1 by groeck@chromium.org
, Jan 30 2018Labels: Security_Severity-High Security_Impact-None Pri-3
Owner: groeck@chromium.org
Status: WontFix (was: Untriaged)
Upstream commit c095508770aebf ("RDS: Heap OOB write in rds_message_alloc_sgs()"). Systems are only affected if CONFIG_RDS is enabled, which is not the case for any Chrome OS images. Already fixed in chromeos-4.14 and chromeos-4.4; won't fix in older releases, and won't cherry-pick to stable releases.