Linux Kernel version 3.18 to 4.16 incorrectly handles an SGIO ioctl on /dev/sg0 with dxferdirection=SGDXFERFROMDEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing chmod o+r+w /dev/sg* to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAPSYSADMIN and CAPSYS_RAWIO capabilities makes it "virtually impossible to exploit.
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"239220577726242301529037768764557736931",
"193073129309083422962353019645579625219",
"45994095312008827407858911279418505889",
"116113301558955558400870514661228550042"
]
},
"source": "https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824",
"deprecated": false,
"id": "CVE-2018-1000204-4bc0dccb",
"signature_type": "Line",
"target": {
"file": "drivers/scsi/sg.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 1881.0,
"function_hash": "181174036924946630152511732961161526541"
},
"source": "https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824",
"deprecated": false,
"id": "CVE-2018-1000204-9d6e0956",
"signature_type": "Function",
"target": {
"function": "sg_build_indirect",
"file": "drivers/scsi/sg.c"
},
"signature_version": "v1"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000204.json"