Updated: 2023-12-06
CWE: Unspecified
Description:
Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually impossible to exploit.
CVSS3: 5.3
| OS | Vendor version | Errata |
|---|---|---|
| Ubuntu 18.04 | 4.15.0-33.36 | USN-3752-1 |
| Ubuntu 16.04 | 4.4.0-130.156 | USN-3696-1 |
| Ubuntu 16.04 AWS | 4.4.0-1062.71 | USN-3696-1 |
| Ubuntu 16.04 HWE | 4.15.0-33.36~16.04.1 | USN-3752-2 |
| Ubuntu 14.04 HWE | 4.4.0-130.156~14.04.1 | USN-3696-2 |
| Debian 8 backports | 4.9.110-1~deb8u1 | DLA-1423-1 |
| Ubuntu 18.04 GCP | 4.15.0-1018.19 | USN-3752-1 |
| Ubuntu 16.04 GCP | 4.15.0-1018.19~16.04.2 | USN-3752-3 |
| Ubuntu 18.04 Azure | 4.15.0-1022.23 | USN-3752-3 |
| Ubuntu 16.04 Azure | 4.15.0-1022.22~16.04.1 | USN-3752-3 |
| Ubuntu 16.04 (FIPS) | 4.4.0-130.156 | usn-3696-1 |
| OS | Original kernel version | State |
|---|---|---|
| Ubuntu 18.04 |
4.15.0-24.26
show all
hide all
4.15.0-32.35
4.15.0-20.21
4.15.0-29.31
4.15.0-23.25
4.15.0-22.24
4.15.0-30.32
|
Released |
| Ubuntu 16.04 |
4.4.0-127.153
show all
hide all
4.4.0-83.106
4.4.0-98.121
4.4.0-72.93
4.4.0-79.100
4.4.0-108.131
4.4.0-116.140
4.4.0-96.119
4.4.0-64.85
4.4.0-124.148
4.4.0-112.135
4.4.0-34.53
4.4.0-22.40
4.4.0-103.126
4.4.0-78.99
4.4.0-31.50
4.4.0-62.83
4.4.0-91.114
4.4.0-97.120
4.4.0-28.47
4.4.0-128.154
4.4.0-119.143
4.4.0-89.112
4.4.0-63.84
4.4.0-24.43
4.4.0-38.57
4.4.0-47.68
4.4.0-67.88
4.4.0-81.104
4.4.0-22.39
4.4.0-93.116
4.4.0-42.62
4.4.0-75.96
4.4.0-51.72
4.4.0-87.110
4.4.0-101.124
4.4.0-36.55
4.4.0-53.74
4.4.0-104.127
4.4.0-109.132
4.4.0-122.146
4.4.0-21.37
4.4.0-23.41
4.4.0-43.63
4.4.0-65.86
4.4.0-70.91
4.4.0-77.98
4.4.0-92.115
4.4.0-45.66
4.4.0-66.87
4.4.0-71.92
4.4.0-121.145
4.4.0-57.78
4.4.0-59.80
|
Released |
| Ubuntu 16.04 AWS |
4.4.0-1031.40
show all
hide all
4.4.0-1037.46
4.4.0-1044.53
4.4.0-1050.59
4.4.0-1020.29
4.4.0-1039.48
4.4.0-1035.44
4.4.0-1026.35
4.4.0-1012.21
4.4.0-1055.64
4.4.0-1017.26
4.4.0-1016.25
4.4.0-1013.22
4.4.0-1030.39
4.4.0-1052.61
4.4.0-1038.47
4.4.0-1028.37
4.4.0-1049.58
4.4.0-1043.52
4.4.0-1060.69
4.4.0-1022.31
4.4.0-1041.50
4.4.0-1057.66
4.4.0-1048.57
4.4.0-1018.27
4.4.0-1032.41
4.4.0-1047.56
4.4.0-1054.63
4.4.0-1061.70
|
Released |
| Ubuntu 16.04 HWE |
4.15.0-24.26~16.04.1
show all
hide all
4.15.0-30.32~16.04.1
4.15.0-29.31~16.04.1
4.15.0-32.35~16.04.1
|
Released |
| Ubuntu 14.04 HWE |
4.4.0-101.124~14.04.1
show all
hide all
4.4.0-91.114~14.04.1
4.4.0-71.92~14.04.1
4.4.0-121.145~14.04.1
4.4.0-97.120~14.04.1
4.4.0-34.53~14.04.1
4.4.0-51.72~14.04.1
4.4.0-79.100~14.04.1
4.4.0-96.119~14.04.1
4.4.0-63.84~14.04.2
4.4.0-81.104~14.04.1
4.4.0-89.112~14.04.1
4.4.0-108.131~14.04.1
4.4.0-98.121~14.04.1
4.4.0-66.87~14.04.1
4.4.0-128.154~14.04.1
4.4.0-53.74~14.04.1
4.4.0-28.47~14.04.1
4.4.0-57.78~14.04.1
4.4.0-111.134~14.04.1
4.4.0-62.83~14.04.1
4.4.0-78.99~14.04.2
4.4.0-64.85~14.04.1
4.4.0-24.43~14.04.1
4.4.0-93.116~14.04.1
4.4.0-47.68~14.04.1
4.4.0-103.126~14.04.1
4.4.0-31.50~14.04.1
4.4.0-83.106~14.04.1
4.4.0-42.62~14.04.1
4.4.0-127.153~14.04.1
4.4.0-38.57~14.04.1
4.4.0-72.93~14.04.1
4.4.0-22.40~14.04.1
4.4.0-104.127~14.04.1
4.4.0-109.132~14.04.1
4.4.0-112.135~14.04.1
4.4.0-21.37~14.04.1
4.4.0-23.41~14.04.1
4.4.0-65.86~14.04.1
4.4.0-70.91~14.04.1
4.4.0-92.115~14.04.1
4.4.0-119.143~14.04.1
4.4.0-75.96~14.04.1
4.4.0-87.110~14.04.1
4.4.0-116.140~14.04.1
4.4.0-124.148~14.04.1
4.4.0-36.55~14.04.1
4.4.0-59.80~14.04.1
4.4.0-67.88~14.04.1
4.4.0-45.66~14.04.1
4.4.0-22.39~14.04.1
|
Released |
| Debian 9 |
4.9.82-1+deb9u2
show all
hide all
4.9.30-2+deb9u1
4.9.88-1
4.9.88-1+deb9u1
4.9.51-1
4.9.30-2+deb9u5
4.9.30-2+deb9u4
4.9.65-1
4.9.80-1
4.9.65-3+deb9u1
4.9.30-2+deb9u3
4.9.30-2+deb9u2
4.9.30-2
4.9.65-3+deb9u2
4.9.65-3
4.9.80-2
4.9.82-1+deb9u3
|
Released |
| Debian 8 backports |
4.9.30-2+deb9u2~bpo8+1
show all
hide all
4.9.30-2+deb9u5~bpo8+1
4.9.30-2~bpo8+1
4.9.51-1~bpo8+1
4.9.65-3+deb9u1~bpo8+1
4.9.65-3+deb9u2~bpo8+1
4.9.65-3~bpo8+1
4.9.82-1+deb9u3~bpo8+1
4.9.88-1+deb9u1~bpo8+1
4.9.88-1~bpo8+1
|
Released |
| Proxmox VE 5 |
4.15.10-1-pve_4.15.10-4
show all
hide all
4.15.15-1-pve_4.15.15-6
4.15.17-1-pve_4.15.17-9
4.15.17-2-pve_4.15.17-10
4.15.18-1-pve_4.15.18-16
4.15.18-1-pve_4.15.18-17
4.15.18-1-pve_4.15.18-19
4.15.18-2-pve_4.15.18-21
4.15.3-1-pve_4.15.3-1
4.15.18-1-pve_4.15.18-15
4.15.18-2-pve_4.15.18-20
4.15.17-3-pve_4.15.17-12
|
Released |
| Ubuntu 18.04 GCP |
4.15.0-1006.6
show all
hide all
4.15.0-1014.14
4.15.0-1010.10
4.15.0-1015.15
4.15.0-1017.18
4.15.0-1009.9
4.15.0-1008.8
|
Released |
| Ubuntu 16.04 GCP |
4.15.0-1017.18~16.04.1
show all
hide all
4.15.0-1014.14~16.04.1
4.15.0-1015.15~16.04.1
|
Released |
| Endurance 6 elrepo |
4.4.112-1.el6.elrepo
|
Released |
| Endurance 7 eig 4.14 | |
Ready For Release |
| Proofpoint | |
Ready For Release |
| Ubuntu 18.04 Azure |
4.15.0-1014.14
show all
hide all
4.15.0-1012.12
4.15.0-1021.21
4.15.0-1009.9
4.15.0-1018.18
4.15.0-1013.13
4.15.0-1019.19
|
Released |
| Ubuntu 16.04 Azure |
4.15.0-1019.19~16.04.1
show all
hide all
4.15.0-1014.14~16.04.1
4.15.0-1021.21~16.04.1
4.15.0-1018.18~16.04.1
4.15.0-1013.13~16.04.2
|
Released |
| Debian 10 cloud | |
Will Not Fix |
| Debian 9 backports | |
Will Not Fix |
| Ubuntu 16.04 (FIPS) |
4.4.0-1002.2
show all
hide all
4.4.0-1003.3
4.4.0-1005.5
4.4.0-1006.6
|
Released |