CVE-2018-20784

moderate-risk

Published 2019-02-22

In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load.

Do I need to act?

0.53% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (7)

Linux Kernel

Ubuntu Linux

Enterprise Linux

Enterprise Linux For Real Time

Affected Vendors

Redhat Linux Canonical

References (18)

Patch http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c40f7d...

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1959

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1971

Release Notes https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.2

Patch https://github.com/torvalds/linux/commit/c40f7d74c741a907cfaeb73a7697081881c497d...

Third Party Advisory https://usn.ubuntu.com/4115-1/

Third Party Advisory https://usn.ubuntu.com/4118-1/

Third Party Advisory https://usn.ubuntu.com/4211-1/

Third Party Advisory https://usn.ubuntu.com/4211-2/