VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel.
Advisory: CVE-2018-1130
Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2018-1130
CVSS severity score: 4.9/10.0
Description:
Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls.
This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.
Comment 1 by zsm@chromium.org
, Jun 14 2018Labels: Security_Severity-Medium Security_Impact-None Pri-2
Owner: zsm@chromium.org
Status: WontFix (was: Untriaged)
Upstream patch is 67f93df79a("dccp: check sk for closed state in dccp_sendmsg()") Patch is present in 4.14, 4.4; not present in older kernels. CONFIG_IP_DCCP is not set in any of the kernels, so marking as WontFix.