The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final thread calling exit_mmap(), which calls munlock_vma_pages_all() for mlocked vmas.This can happen synchronously with the oom reaper's unmap_page_range() since the vma's VM_LOCKED bit is cleared before munlocking (to determine if any other vmas share the memory and are mlocked).
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel | Aug 28, 2019 | Jun 5, 2018 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 5, 2018 |
| Redhat_linux | — | Upgrade kernel | Oct 31, 2018 | Jun 5, 2018 |
| Suse | — | Upgrade kernel-source-azureUpgrade kernel-default-extraUpgrade cluster-md-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-default-manUpgrade kernel-defaultUpgrade kernel-azure-baseUpgrade ocfs2-kmp-defaultUpgrade kernel-docsUpgrade gfs2-kmp-defaultUpgrade kernel-obs-buildUpgrade dlm-kmp-default | Jul 29, 2018 | Jun 5, 2018 |
| Ubuntu | — | Upgrade linux-image-4.15.0-33-genericUpgrade linux-image-4.15.0-1020-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-1020-awsUpgrade linux-image-generic-lpaeUpgrade linux-image-oemUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.15.0-33-generic-lpaeUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-4.15.0-1022-azureUpgrade linux-image-4.15.0-1017-oemUpgrade linux-image-awsUpgrade linux-image-kvmUpgrade linux-image-4.15.0-33-snapdragonUpgrade linux-image-snapdragonUpgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-4.15.0-1018-gcpUpgrade linux-image-gkeUpgrade linux-image-azureUpgrade linux-image-4.15.0-1021-raspi2Upgrade linux-image-gcpUpgrade linux-image-4.15.0-33-lowlatencyUpgrade linux-image-azure-edgeUpgrade linux-image-genericUpgrade linux-image-raspi2 | Aug 31, 2018 | Jun 5, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub