CVE-2018-16862 | BDVDB-2026-109745 Detail
[UNKNOWN]kernel:
Description#
A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.
Impact#
Per CVSS v3.0: confidentiality impact high, integrity impact low, availability impact none. Attack vector: local.
Weaknesses#
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References#
- http://www.securityfocus.com/bid/106009
- https://usn.ubuntu.com/3879-2/
- https://seclists.org/oss-sec/2018/q4/169
- https://usn.ubuntu.com/3879-1/
- https://lore.kernel.org/patchwork/patch/1011367/
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16862
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
- https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html
- https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html
- https://usn.ubuntu.com/4094-1/
- https://usn.ubuntu.com/4118-1/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.