An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://usn.ubuntu.com/3695-1/ | vendor-advisory x_refsource_UBUNTU |
| https://usn.ubuntu.com/3696-1/ | vendor-advisory x_refsource_UBUNTU |
| https://usn.ubuntu.com/3695-2/ | vendor-advisory x_refsource_UBUNTU |
| https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html | mailing-list x_refsource_MLIST |
| https://usn.ubuntu.com/3697-1/ | vendor-advisory x_refsource_UBUNTU |
| https://lkml.org/lkml/2018/3/7/1116 | x_refsource_MISC |
| https://usn.ubuntu.com/3697-2/ | vendor-advisory x_refsource_UBUNTU |
| https://www.debian.org/security/2018/dsa-4308 | vendor-advisory x_refsource_DEBIAN |
| https://usn.ubuntu.com/3698-1/ | vendor-advisory x_refsource_UBUNTU |
| https://usn.ubuntu.com/3696-2/ | vendor-advisory x_refsource_UBUNTU |
| https://usn.ubuntu.com/3698-2/ | vendor-advisory x_refsource_UBUNTU |
| https://access.redhat.com/errata/RHSA-2019:2043 | vendor-advisory x_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:2029 | vendor-advisory x_refsource_REDHAT |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://usn.ubuntu.com/3695-1/ | vendor-advisory x_refsource_UBUNTU x_transferred |
| https://usn.ubuntu.com/3696-1/ | vendor-advisory x_refsource_UBUNTU x_transferred |
| https://usn.ubuntu.com/3695-2/ | vendor-advisory x_refsource_UBUNTU x_transferred |
| https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html | mailing-list x_refsource_MLIST x_transferred |
| https://usn.ubuntu.com/3697-1/ | vendor-advisory x_refsource_UBUNTU x_transferred |
| https://lkml.org/lkml/2018/3/7/1116 | x_refsource_MISC x_transferred |
| https://usn.ubuntu.com/3697-2/ | vendor-advisory x_refsource_UBUNTU x_transferred |
| https://www.debian.org/security/2018/dsa-4308 | vendor-advisory x_refsource_DEBIAN x_transferred |
| https://usn.ubuntu.com/3698-1/ | vendor-advisory x_refsource_UBUNTU x_transferred |
| https://usn.ubuntu.com/3696-2/ | vendor-advisory x_refsource_UBUNTU x_transferred |
| https://usn.ubuntu.com/3698-2/ | vendor-advisory x_refsource_UBUNTU x_transferred |
| https://access.redhat.com/errata/RHSA-2019:2043 | vendor-advisory x_refsource_REDHAT x_transferred |
| https://access.redhat.com/errata/RHSA-2019:2029 | vendor-advisory x_refsource_REDHAT x_transferred |