In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sockclose and sockfssetattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12232.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d8c50dcb029872b298eea68cc6209c866fd3e14",
"digest": {
"function_hash": "114313490272428403537005136987784660184",
"length": 374.0
},
"id": "CVE-2018-12232-17187f23",
"deprecated": false,
"target": {
"file": "net/socket.c",
"function": "sock_release"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d8c50dcb029872b298eea68cc6209c866fd3e14",
"digest": {
"line_hashes": [
"173292538334678232230038936128488119221",
"233985866829144282917536195573912102847",
"296276233127890900412524653477185629560",
"65881486324767546035066866133801736695",
"129147539362214290891934005122921534662",
"256632645712398189056254707525960695908",
"261573143662025253374993810892645292449",
"202168200465033621446355280994578913091",
"97280222755694764718789075090766535264",
"147279612641584237627227980837959816735",
"138028657604927186808262626003828379045",
"103815567677884979678452819832073382212",
"86864455135947581263018198571067664920",
"128035864010211451574310592106768639997",
"243477438354718807611777872936779412197",
"66440629240804556301651076894586562924",
"312767738602959915059009996421845665131",
"303948274775869820776188129619400589750",
"67675578576555123891476297260387551389",
"197062779197416118573199202841730440969"
],
"threshold": 0.9
},
"id": "CVE-2018-12232-2edcfb05",
"deprecated": false,
"target": {
"file": "net/socket.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d8c50dcb029872b298eea68cc6209c866fd3e14",
"digest": {
"function_hash": "82617837442264092889144085866343020906",
"length": 104.0
},
"id": "CVE-2018-12232-97953c9b",
"deprecated": false,
"target": {
"file": "net/socket.c",
"function": "sock_close"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6d8c50dcb029872b298eea68cc6209c866fd3e14",
"digest": {
"function_hash": "42840221627976439775197586632643438212",
"length": 254.0
},
"id": "CVE-2018-12232-c141c535",
"deprecated": false,
"target": {
"file": "net/socket.c",
"function": "sockfs_setattr"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12232.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/6d8c50dcb029872b298eea68cc6209c866fd3e14",
"digest": {
"function_hash": "42840221627976439775197586632643438212",
"length": 254.0
},
"id": "CVE-2018-12232-187628fb",
"deprecated": false,
"target": {
"file": "net/socket.c",
"function": "sockfs_setattr"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/6d8c50dcb029872b298eea68cc6209c866fd3e14",
"digest": {
"line_hashes": [
"173292538334678232230038936128488119221",
"233985866829144282917536195573912102847",
"296276233127890900412524653477185629560",
"65881486324767546035066866133801736695",
"129147539362214290891934005122921534662",
"256632645712398189056254707525960695908",
"261573143662025253374993810892645292449",
"202168200465033621446355280994578913091",
"97280222755694764718789075090766535264",
"147279612641584237627227980837959816735",
"138028657604927186808262626003828379045",
"103815567677884979678452819832073382212",
"86864455135947581263018198571067664920",
"128035864010211451574310592106768639997",
"243477438354718807611777872936779412197",
"66440629240804556301651076894586562924",
"312767738602959915059009996421845665131",
"303948274775869820776188129619400589750",
"67675578576555123891476297260387551389",
"197062779197416118573199202841730440969"
],
"threshold": 0.9
},
"id": "CVE-2018-12232-84ed8c1b",
"deprecated": false,
"target": {
"file": "net/socket.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/6d8c50dcb029872b298eea68cc6209c866fd3e14",
"digest": {
"function_hash": "114313490272428403537005136987784660184",
"length": 374.0
},
"id": "CVE-2018-12232-8e8afaae",
"deprecated": false,
"target": {
"file": "net/socket.c",
"function": "sock_release"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/6d8c50dcb029872b298eea68cc6209c866fd3e14",
"digest": {
"function_hash": "82617837442264092889144085866343020906",
"length": 104.0
},
"id": "CVE-2018-12232-e7a871b3",
"deprecated": false,
"target": {
"file": "net/socket.c",
"function": "sock_close"
}
}
]