1

I have a Debian system running the following kernel version:

Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux

Distributor ID: Debian Description: Debian GNU/Linux 9.5 (stretch) Release: 9.5 Codename: stretch Codename: stretch

Is this kernel vulnerable to CVE-2018-17182?

This is my reference:

https://www.securityweek.com/google-project-zero-discloses-new-linux-kernel-flaw

https://security-tracker.debian.org/tracker/CVE-2018-17182

1

Yes. All mainline kernels from 3.15-rc8 commit 6b4ebc3a9078c5b7b8c4cf495a0b1d2d0e0bfe7a, up to the patch in 4.19-rc3 commit 7a9cdebdcc17e426fb5287e4a82db1dfe86339b2 are affected, and the Debian team has not patched it downstream for the version you are using.

  • Note that kernels which default to kernel.panic_on_oops=1 are not affected. – forest Sep 28 '18 at 10:40
  • @forest Source? Won't that just make the kernel panic after the bug is triggered? I wouldn't call that "not affected" if that's the case. – anon Sep 28 '18 at 11:10
  • It will make the kernel panic when the bug is triggered. Setting that sysctl (or setting it as a boot parameter) turns a privesc bug into a DoS bug. – forest Sep 28 '18 at 12:14
  • How to know default kernel.panic_on_oops value for my kernel? – Dark Cyber Sep 30 '18 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.