CVE-2018-1000199

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.

This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

This issue affects the version of the kernel package as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2 may address this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue:

1. Save the following script in a 'CVE-2018-1000199.stp' file.

probe kernel.function("ptrace_set_debugreg") { if ($n < 4) $n = 4; /* set invalid debug register #, returns -EIO */ } probe begin { printk(0, "CVE-2018-1000199 mitigation loaded") } probe end { printk(0, "CVE-2018-1000199 mitigation unloaded") }

2. Install systemtap package and its dependencies

   yum install -y systemtap systemtap-runtime

   yum install -y kernel-devel kernel-debuginfo kernel-debuginfo-common

3. Build the mitigation kernel module as root.

   stap -r uname -r -m cve_2018_1000199.ko -g CVE-2018-1000199.stp -p4

4. Load the mitigation module as root

   staprun -L cve_2018_1000199.ko