Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Linux kernel up to 4.19.2 lets local user crash system

CVE-2018-19407 · published 7 years ago
Summary

The Linux kernel (versions up to 4.19.2) and Ubuntu builds that use it can be forced to stop working by a local user who runs specially crafted commands. This happens because a part of the virtual CPU code can try to use something that hasn't been set up, causing the system to crash. Updating the kernel to a newer version that includes the fix will prevent this from happening.

What to do
  • Update canonical linux-aws to version 4.4.0-1038.41.
  • Update canonical linux-azure to version 4.15.0-1037.39~14.04.2.
  • Update canonical linux-lts-xenial to version 4.4.0-142.168~14.04.1.
  • Update canonical linux to version 4.4.0-142.168.
  • Update canonical linux-aws to version 4.4.0-1075.85.
  • Update canonical linux-aws-hwe to version 4.15.0-1032.34~16.04.1.
  • Update canonical linux-azure to version 4.15.0-1037.39~16.04.1.
  • Update canonical linux-gcp to version 4.15.0-1027.28~16.04.1.
  • Update canonical linux-hwe to version 4.15.0-45.48~16.04.1.
  • Update canonical linux-kvm to version 4.4.0-1040.46.
  • Update canonical linux-raspi2 to version 4.4.0-1103.111.
  • Update canonical linux-snapdragon to version 4.4.0-1107.112.
  • Update canonical linux-fips to version 4.4.0-1008.10.
  • Update canonical linux to version 4.15.0-44.47.
  • Update canonical linux-aws to version 4.15.0-1032.34.
  • Update canonical linux-azure to version 4.15.0-1037.39.
  • Update canonical linux-gcp to version 4.15.0-1027.28.
  • Update canonical linux-gcp-edge to version 4.18.0-1006.7~18.04.1.
  • Update canonical linux-hwe to version 4.18.0-14.15~18.04.1.
  • Update canonical linux-kvm to version 4.15.0-1029.29.
  • Update canonical linux-oem to version 4.15.0-1033.38.
  • Update canonical linux-raspi2 to version 4.15.0-1031.33.
  • Update debian linux to version 4.19.9-1.
Affected software
Ecosystem VendorProductAffected versions
– linux linux_kernel <= 4.19.2
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
– canonical ubuntu_linux 14.04
16.04
18.04
18.10
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Ubuntu:14.04:LTS canonical linux-aws < 4.4.0-1038.41
Fix: upgrade to 4.4.0-1038.41
Ubuntu:14.04:LTS canonical linux-azure < 4.15.0-1037.39~14.04.2
Fix: upgrade to 4.15.0-1037.39~14.04.2
Ubuntu:14.04:LTS canonical linux-lts-xenial < 4.4.0-142.168~14.04.1
Fix: upgrade to 4.4.0-142.168~14.04.1
Ubuntu:16.04:LTS canonical linux < 4.4.0-142.168
Fix: upgrade to 4.4.0-142.168
Ubuntu:16.04:LTS canonical linux-aws < 4.4.0-1075.85
Fix: upgrade to 4.4.0-1075.85
Ubuntu:16.04:LTS canonical linux-aws-hwe < 4.15.0-1032.34~16.04.1
Fix: upgrade to 4.15.0-1032.34~16.04.1
Ubuntu:16.04:LTS canonical linux-azure < 4.15.0-1037.39~16.04.1
Fix: upgrade to 4.15.0-1037.39~16.04.1
Ubuntu:16.04:LTS canonical linux-gcp < 4.15.0-1027.28~16.04.1
Fix: upgrade to 4.15.0-1027.28~16.04.1
Ubuntu:16.04:LTS canonical linux-hwe < 4.15.0-45.48~16.04.1
Fix: upgrade to 4.15.0-45.48~16.04.1
Ubuntu:16.04:LTS canonical linux-kvm < 4.4.0-1040.46
Fix: upgrade to 4.4.0-1040.46
Ubuntu:16.04:LTS canonical linux-raspi2 < 4.4.0-1103.111
Fix: upgrade to 4.4.0-1103.111
Ubuntu:16.04:LTS canonical linux-snapdragon < 4.4.0-1107.112
Fix: upgrade to 4.4.0-1107.112
Ubuntu:Pro:FIPS-updates:16.04:LTS canonical linux-fips < 4.4.0-1008.10
Fix: upgrade to 4.4.0-1008.10
Ubuntu:18.04:LTS canonical linux < 4.15.0-44.47
Fix: upgrade to 4.15.0-44.47
Ubuntu:18.04:LTS canonical linux-aws < 4.15.0-1032.34
Fix: upgrade to 4.15.0-1032.34
Ubuntu:18.04:LTS canonical linux-azure < 4.15.0-1037.39
Fix: upgrade to 4.15.0-1037.39
Ubuntu:18.04:LTS canonical linux-gcp < 4.15.0-1027.28
Fix: upgrade to 4.15.0-1027.28
Ubuntu:18.04:LTS canonical linux-gcp-edge < 4.18.0-1006.7~18.04.1
Fix: upgrade to 4.18.0-1006.7~18.04.1
Ubuntu:18.04:LTS canonical linux-hwe < 4.18.0-14.15~18.04.1
Fix: upgrade to 4.18.0-14.15~18.04.1
Ubuntu:18.04:LTS canonical linux-kvm < 4.15.0-1029.29
Fix: upgrade to 4.15.0-1029.29
Ubuntu:18.04:LTS canonical linux-oem < 4.15.0-1033.38
Fix: upgrade to 4.15.0-1033.38
Ubuntu:18.04:LTS canonical linux-raspi2 < 4.15.0-1031.33
Fix: upgrade to 4.15.0-1031.33
Ubuntu:20.04:LTS canonical linux-azure-fde All versions
Ubuntu:20.04:LTS canonical linux-gke All versions
Ubuntu:20.04:LTS canonical linux-raspi2 All versions
Ubuntu:20.04:LTS canonical linux-riscv All versions
Ubuntu:22.04:LTS canonical linux-intel-iot-realtime All versions
Ubuntu:22.04:LTS canonical linux-realtime All versions
Ubuntu:24.04:LTS canonical linux-raspi-realtime All versions
Debian:12 debian linux < 4.19.9-1
Fix: upgrade to 4.19.9-1
Original advisory text
The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls th...
The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-476NULL Pointer Dereference
Timeline
Published21 Nov 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-19407 · NVD
UBUNTU-CVE-2018-19407 · OSV
DEBIAN-CVE-2018-19407 · OSV
Track software like this
Free during beta