The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final thread calling exit_mmap(), which calls munlock_vma_pages_all() for mlocked vmas.This can happen synchronously with the oom reaper's unmap_page_range() since the vma's VM_LOCKED bit is cleared before munlocking (to determine if any other vmas share the memory and are mlocked).
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel | Aug 28, 2019 | Jun 5, 2018 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 5, 2018 |
| Redhat_linux | — | Upgrade kernel | Oct 31, 2018 | Jun 5, 2018 |
| Suse | — | Upgrade kernel-azure-baseUpgrade kernel-docsUpgrade ocfs2-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-default-extraUpgrade kernel-default-manUpgrade cluster-md-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-source-azure | Jul 29, 2018 | Jun 5, 2018 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.15.0-33-genericUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-lowlatencyUpgrade linux-image-awsUpgrade linux-image-generic-lpaeUpgrade linux-image-oemUpgrade linux-image-4.15.0-1020-awsUpgrade linux-image-4.15.0-1020-kvmUpgrade linux-image-4.15.0-1022-azureUpgrade linux-image-4.15.0-33-generic-lpaeUpgrade linux-image-4.15.0-1017-oemUpgrade linux-image-kvmUpgrade linux-image-genericUpgrade linux-image-4.15.0-1021-raspi2Upgrade linux-image-gkeUpgrade linux-image-4.15.0-1018-gcpUpgrade linux-image-azureUpgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-raspi2Upgrade linux-image-snapdragonUpgrade linux-image-azure-edgeUpgrade linux-image-4.15.0-33-snapdragonUpgrade linux-image-4.15.0-33-lowlatencyUpgrade linux-image-gcp | Aug 31, 2018 | Jun 5, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub