Issue metadata
Sign in to add a comment
|
CVE-2017-18218 CrOS: Vulnerability reported in Linux kernel |
||||||||||||||||||||
Issue descriptionVOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. Advisory: CVE-2017-18218 Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-18218 CVSS severity score: 7.2/10.0 Description: In drivers/net/ethernet/hisilicon/hns/hns_enet.c in the Linux kernel before 4.13, local users can cause a denial of service (use-after-free and BUG) or possibly have unspecified other impact by leveraging differences in skb handling between hns_nic_net_xmit_hw and hns_nic_net_xmit. This bug was filed by http://go/vomit Please contact us at vomit-team@google.com if you need any assistance.
,
Mar 27 2018
CONFIG_NET_VENDOR_HISILICON is not set on COS. No impact on lakitu. |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by groeck@chromium.org
, Mar 27 2018Labels: Security_Impact_None Security_Severity_Low Pri-3
Owner: groeck@chromium.org
Status: WontFix (was: Untriaged)
Upstream commit 27463ad99f738 ("net: hns: Fix a skb used after free bug"). chromeos-4.14 is not affected per CVE. chromeos-4.4 and possibly earlier are theoretically affected. However, CONFIG_HNS is not enabled in ChromeOS images, and the patch does not apply cleanly. Marking as WontFix.