Linux Kernel up to 4.15.7 sas_expander.c sas_smp_get_phy_events resource management
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 4.3 | $0-$5k | 0.00 |
Summary
A vulnerability was found in Linux Kernel up to 4.15.7. It has been rated as problematic. This impacts the function sas_smp_get_phy_events in the library drivers/scsi/libsas/sas_expander.c. The manipulation leads to resource management.
This vulnerability is listed as CVE-2018-7757. The attack must be carried out locally. There is no available exploit.
Upgrading the affected component is advised.
Details
A vulnerability was found in Linux Kernel up to 4.15.7 (Operating System) and classified as problematic. This issue affects the function sas_smp_get_phy_events in the library drivers/scsi/libsas/sas_expander.c. The manipulation with an unknown input leads to a resource management vulnerability. Using CWE to declare the problem leads to CWE-399. Impacted is availability. The summary by CVE is:
Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file.
The bug was discovered 03/08/2018. The weakness was presented 03/08/2018 (Website). The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2018-7757 since 03/08/2018. The exploitation is known to be easy. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.
The vulnerability scanner Nessus provides a plugin with the ID 109758 (SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1221-1)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 157853 (Oracle Enterprise Linux Security Update for Unbreakable Enterprise kernel (ELSA-2018-4265)).
Upgrading eliminates this vulnerability. A possible mitigation has been published 3 months after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at Tenable (109758), SecurityFocus (BID 103348†) and CERT Bund (WID-SEC-2022-0532). See VDB-109544, VDB-110290, VDB-111669 and VDB-113900 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Affected
- Oracle Linux
- Debian Linux
- Open Source Linux Kernel
- Red Hat Enterprise Linux
- Ubuntu Linux
- SUSE Linux
- Oracle VM
- NetApp FAS
- Avaya Aura Communication Manager
- Avaya Aura Session Manager
- Avaya Aura Application Enablement Services
- Avaya Aura System Manager
- Avaya Aura Experience Portal
- NetApp AFF
Product
Type
Vendor
Name
Version
License
Website
- Vendor: https://www.kernel.org/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.4VulDB Meta Temp Score: 4.3
VulDB Base Score: 3.3
VulDB Temp Score: 3.2
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 5.5
NVD Vector: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Resource managementCWE: CWE-399 / CWE-404
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Nessus ID: 109758
Nessus Name: SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1221-1)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
OpenVAS ID: 63700
OpenVAS Name: Fedora Update for kernel FEDORA-2018-2bce10900e
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Patch: git.kernel.org
Timeline
03/08/2018 🔍03/08/2018 🔍
03/08/2018 🔍
03/08/2018 🔍
03/08/2018 🔍
03/09/2018 🔍
05/11/2018 🔍
05/14/2018 🔍
09/14/2025 🔍
Sources
Vendor: kernel.orgAdvisory: RHSA-2018:2948
Status: Confirmed
CVE: CVE-2018-7757 (🔍)
GCVE (CVE): GCVE-0-2018-7757
GCVE (VulDB): GCVE-100-114233
OVAL: 🔍
SecurityFocus: 103348 - Linux Kernel 'drivers/scsi/libsas/sas_expander.c' Local Denial of Service Vulnerability
CERT Bund: WID-SEC-2022-0532 - Linux Kernel: Mehrere Schwachstellen
See also: 🔍
Entry
Created: 03/09/2018 07:47Updated: 09/14/2025 06:07
Changes: 03/09/2018 07:47 (77), 01/11/2020 15:45 (5), 02/17/2023 14:51 (5), 09/14/2025 06:07 (21)
Complete: 🔍
Cache ID: 216:2AA:103
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
No comments yet. Languages: en.
Please log in to comment.