The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final thread calling exitmmap(), which calls munlockvmapagesall() for mlocked vmas.This can happen synchronously with the oom reaper's unmappagerange() since the vma's VM_LOCKED bit is cleared before munlocking (to determine if any other vmas share the memory and are mlocked).
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000200.json"
[
{
"id": "CVE-2018-1000200-02956b92",
"target": {
"file": "mm/oom_kill.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@27ae357fa82be5ab73b2ef8d39dcb8ca2563483a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283169587166752369450441723976207315447",
"44006491189195822479373714895705030389",
"155655773734362513699423727133511418386",
"94698017457600653602118128990765607011",
"229176031192461279560122686470500345962",
"190939781557711183542457540151114369172",
"319585572686366738672700061935122677916",
"303474196752714501072472042799004509786",
"306691738562660184400749501024373016423",
"317911329333332746056474685523985452594",
"134895632923708641404594247488191204466",
"320626058996042426831286898097675875335",
"102416721360796565514603023711448911434",
"235755170588851574347063790987807174686",
"148159219917133625284550997537058857382",
"55190239216998083951461344664981392628",
"114527176767399772800500103400561930074",
"13628333925537917474642878929023077462",
"228543130601393439844313211070904022546",
"335767051386995801275276177188541327947",
"250873062843170398047511814537524114742",
"243349709657310859718968847855268432180",
"275912873547522048586542600595446623938",
"148688349039927081170837214301537499438",
"238223864613751020877616958967780920035",
"87766924956734492522814975578920108615",
"190762847275117583540802368626276663015",
"56581698202236927723274993856609741768",
"97223771306464901190411914623866208192",
"123834572182563494096809547930942830350",
"160136668481800340003429194010826255720",
"268807084565483384545911310890024323244",
"44523910693635520526120372701622148265",
"76178818830290261820761360867922207167",
"206801513962027953570300498807219138483",
"256958938468138770344781619657853009680"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2018-1000200-30b48f8d",
"target": {
"file": "mm/mmap.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@27ae357fa82be5ab73b2ef8d39dcb8ca2563483a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"155808628464209311806744776107020493651",
"202158634858829440044990443013921150385",
"256806404249012625150492813702234779803",
"162779936092353207393983733803278655714",
"95404444189938772825066051151073803566",
"331706282477891345794841182863190922939",
"72900668935125145818704323361828250406",
"107691642788897482836771554100600194384",
"247819683240237808324053223755207854654",
"54742626402783011325782959431252304616",
"61492824939515362488802063531630557385"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2018-1000200-463948f4",
"target": {
"function": "__oom_reap_task_mm",
"file": "mm/oom_kill.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@27ae357fa82be5ab73b2ef8d39dcb8ca2563483a",
"digest": {
"function_hash": "40729623112185795006005476069527377657",
"length": 1393.0
},
"signature_type": "Function"
},
{
"id": "CVE-2018-1000200-db7986c7",
"target": {
"function": "exit_mmap",
"file": "mm/mmap.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@27ae357fa82be5ab73b2ef8d39dcb8ca2563483a",
"digest": {
"function_hash": "263704376937588528399381082192290530244",
"length": 819.0
},
"signature_type": "Function"
},
{
"id": "CVE-2018-1000200-ff0f4090",
"target": {
"file": "include/linux/oom.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@27ae357fa82be5ab73b2ef8d39dcb8ca2563483a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"145080880554529898750345335090276204179",
"279848973891073904144841515310976783612",
"87642019313074275271301809092183287535"
]
},
"signature_type": "Line"
}
]