VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel.
Advisory: CVE-2018-11232
Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2018-11232
CVSS severity score: 4.9/10.0
Description:
The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service (panic) because a parameter is incorrectly used as a local variable.
This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.
Comment 1 by zsm@chromium.org
, Jun 20 2018Labels: Security_Severity-Low Security_Impact-None Pri-3
Owner: zsm@chromium.org
Status: WontFix (was: Untriaged)
Upstream commit is f094446390("coresight: fix kernel panic caused by invalid CPU"). The commit is present in 4.14. Older kernels do not have this commit. CONFIG_CORESIGHT does not seem to be set in any of the kernels, so marking as WontFix.