The srdoioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11506.json"
[
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f7068114d45ec55996b9040e98111afa56e010fe",
"digest": {
"line_hashes": [
"268250879442337274394184041298001740771",
"130743151893403298417865022169007804134",
"257789033024051136795732547365623686429",
"326149978655972237619733898410302312592",
"291690659732843564072863477569531247188",
"58219576628567325084901575440384679292",
"28070701396954675844377882706522864689",
"99812092650910892436159861405452387318",
"278740171914084658080562522691150396450",
"250363930480820049186540062874802552815",
"167489159534842493623850630947877772904"
],
"threshold": 0.9
},
"id": "CVE-2018-11506-4d1394b3",
"deprecated": false,
"target": {
"file": "drivers/scsi/sr_ioctl.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f7068114d45ec55996b9040e98111afa56e010fe",
"digest": {
"function_hash": "72201474148433294262535741775843557813",
"length": 1238.0
},
"id": "CVE-2018-11506-5e36c8ab",
"deprecated": false,
"target": {
"file": "drivers/scsi/sr_ioctl.c",
"function": "sr_do_ioctl"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11506.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/f7068114d45ec55996b9040e98111afa56e010fe",
"digest": {
"function_hash": "72201474148433294262535741775843557813",
"length": 1238.0
},
"id": "CVE-2018-11506-55dd247e",
"deprecated": false,
"target": {
"file": "drivers/scsi/sr_ioctl.c",
"function": "sr_do_ioctl"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/f7068114d45ec55996b9040e98111afa56e010fe",
"digest": {
"line_hashes": [
"268250879442337274394184041298001740771",
"130743151893403298417865022169007804134",
"257789033024051136795732547365623686429",
"326149978655972237619733898410302312592",
"291690659732843564072863477569531247188",
"58219576628567325084901575440384679292",
"28070701396954675844377882706522864689",
"99812092650910892436159861405452387318",
"278740171914084658080562522691150396450",
"250363930480820049186540062874802552815",
"167489159534842493623850630947877772904"
],
"threshold": 0.9
},
"id": "CVE-2018-11506-a8e04b42",
"deprecated": false,
"target": {
"file": "drivers/scsi/sr_ioctl.c"
}
}
]