High severity7.8NVD Advisory· Published Jun 12, 2018· Updated Jun 17, 2026

CVE-2018-12233

Description

In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Linux/Kernelllm-fuzzy
Range: <=4.17.1
osv-coords69 versions
pkg:rpm/suse/kernel-bigmem&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/kernel-bigmem&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/kernel-bigsmp&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2012%20SP3 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP3 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015 pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015 pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/kernel-ec2&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/kernel-ec2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/kernel-ec2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/kernel-ec2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/kernel-livepatch-SLE15_Update_1&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015 pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015 pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/kernel-pae&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/kernel-pae&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/kernel-pae&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/kernel-pae&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/kernel-ppc64&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/kernel-ppc64&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/kernel-rt_debug&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP3 pkg:rpm/suse/kernel-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2011%20SP4 pkg:rpm/suse/kernel-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP3 pkg:rpm/suse/kernel-rt_trace&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2011%20SP4 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/kernel-source-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2011%20SP4 pkg:rpm/suse/kernel-source-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP3 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/kernel-syms-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2011%20SP4 pkg:rpm/suse/kernel-syms-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP3 pkg:rpm/suse/kernel-trace&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/kernel-trace&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/kernel-trace&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/kernel-trace&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/kernel-vanilla&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015 pkg:rpm/suse/kernel-xen&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/kernel-xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/kernel-xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/kernel-xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/kgraft-patch-SLE12-SP3_Update_14&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2012%20SP3
< 3.0.101-108.68.1+ 68 more
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 1-1.3.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 4.4.138-3.14.1
- (no CPE)range: < 3.0.101.rt130-69.33.1
- (no CPE)range: < 4.4.138-3.14.1
- (no CPE)range: < 3.0.101.rt130-69.33.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 3.0.101.rt130-69.33.1
- (no CPE)range: < 4.4.138-3.14.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 4.4.138-94.39.1
- (no CPE)range: < 3.0.101.rt130-69.33.1
- (no CPE)range: < 4.4.138-3.14.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-0.47.106.43.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 3.0.101-108.68.1
- (no CPE)range: < 4.12.14-25.3.1
- (no CPE)range: < 1-4.5.1

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/104452nvdThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2018/07/msg00015.htmlnvdThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2018/07/msg00016.htmlnvdThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2018/07/msg00020.htmlnvdThird Party AdvisoryVDB Entry
lkml.org/lkml/2018/6/2/2nvdThird Party AdvisoryVDB Entry
marc.infonvdThird Party Advisory
usn.ubuntu.com/3752-1/nvdThird Party AdvisoryVDB Entry
usn.ubuntu.com/3752-2/nvdThird Party AdvisoryVDB Entry
usn.ubuntu.com/3752-3/nvdThird Party AdvisoryVDB Entry
usn.ubuntu.com/3753-1/nvdThird Party AdvisoryVDB Entry
usn.ubuntu.com/3753-2/nvdThird Party AdvisoryVDB Entry
usn.ubuntu.com/3754-1/nvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000