1

I have a Debian system running the following kernel version:

Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux

Distributor ID: Debian Description: Debian GNU/Linux 9.5 (stretch) Release: 9.5 Codename: stretch Codename: stretch

Is this kernel vulnerable to CVE-2018-17182?

This is my reference:

https://www.securityweek.com/google-project-zero-discloses-new-linux-kernel-flaw

https://security-tracker.debian.org/tracker/CVE-2018-17182

Improve this question

1 Answer 1

Reset to default
1

Yes. All mainline kernels from 3.15-rc8 commit 6b4ebc3a9078c5b7b8c4cf495a0b1d2d0e0bfe7a, up to the patch in 4.19-rc3 commit 7a9cdebdcc17e426fb5287e4a82db1dfe86339b2 are affected, and the Debian team has not patched it downstream for the version you are using.

Improve this answer
4
  • Note that kernels which default to kernel.panic_on_oops=1 are not affected.
    – forest
    Commented Sep 28, 2018 at 10:40
  • @forest Source? Won't that just make the kernel panic after the bug is triggered? I wouldn't call that "not affected" if that's the case.
    – anon
    Commented Sep 28, 2018 at 11:10
  • It will make the kernel panic when the bug is triggered. Setting that sysctl (or setting it as a boot parameter) turns a privesc bug into a DoS bug.
    – forest
    Commented Sep 28, 2018 at 12:14
  • How to know default kernel.panic_on_oops value for my kernel?
    – Dark Cyber
    Commented Sep 30, 2018 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .