Skip to content
OpenAdvisories
Unscored CVE-2018-9422 EUVD-2018-21016GHSA-7jfq-4vfx-p3rg

In get_futex_key of futex.c, there is a use-after-free due to improper locking. This could lead to local escalation of privilege with no ad…

Published Nov 6, 2018 · Updated Sep 16, 2024 · Assigned by google_android

Vendor: Google Product: Android Package: linux Package: linux Package: linux-aws Package: linux-azure-6.11 Package: linux-azure-fde Package: linux-azure-fde-5.15 Package: linux-fips Package: linux-gcp-6.11 Package: linux-gke Package: linux-hwe-6.11 Package: linux-intel-iot-realtime Package: linux-kvm Package: linux-lowlatency-hwe-6.11 Package: linux-lts-xenial Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-snapdragon Platform: Android Ecosystem: Debian Ecosystem: Ubuntu

Description

In get_futex_key of futex.c, there is a use-after-free due to improper locking. This could lead to local escalation of privilege with no additional privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-74250718 References: Upstream kernel.

Affected products

VendorProductAffectedFixed
Google Android Android kernel —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 linux 4.6.1-1 —
Debian 13 linux 4.6.1-1 —
Debian 12 linux 4.6.1-1 —
Debian 8 linux 3.16.57-1 DLA-1422-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-gcp-6.11 +4 No fix yet —
Ubuntu 22.04 LTS linux-riscv +2 No fix yet —
Ubuntu 20.04 LTS linux-gke +3 No fix yet —
Ubuntu 18.04 LTS linux-snapdragon 4.15.0-1053.57 —
Ubuntu 16.04 LTS linux 4.4.0-127.153 —
Ubuntu 16.04 LTS linux-aws 4.4.0-1060.69 —
Ubuntu 16.04 LTS linux-kvm 4.4.0-1026.31 —
Ubuntu 16.04 LTS linux-raspi2 4.4.0-1090.98 —
Ubuntu 16.04 LTS linux-snapdragon 4.4.0-1093.98 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS linux-aws 4.4.0-1022.22 —
Ubuntu 14.04 LTS linux-lts-xenial 4.4.0-127.153~14.04.1 —
Ubuntu Pro FIPS-updates 16.04 LTS linux-fips 4.4.0-1008.10 —
Ubuntu Pro 20.04 LTS linux-azure-fde-5.15 No fix yet —
Ubuntu Pro 14.04 LTS linux No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 kernel-uek +5 4.1.12-124.67.3.el7uek ELSA-2022-9852

Advisories 3

References