An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INTMAX, but the accounting is int based. This basically makes the accounting values, which are visible to user space via timergetoverrun(2) and siginfo::sioverrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timercreate, and timer_settime system calls.
[
{
"id": "CVE-2018-12896-28e3de18",
"signature_version": "v1",
"digest": {
"function_hash": "22023615035054443685787805871590382035",
"length": 258.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76",
"signature_type": "Function",
"target": {
"file": "kernel/time/posix-timers.c",
"function": "common_hrtimer_rearm"
}
},
{
"id": "CVE-2018-12896-5807d64c",
"signature_version": "v1",
"digest": {
"function_hash": "2990970529004368528672836703713200219",
"length": 220.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76",
"signature_type": "Function",
"target": {
"file": "kernel/time/posix-timers.c",
"function": "SYSCALL_DEFINE1"
}
},
{
"id": "CVE-2018-12896-72996d38",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175930821163590023436933614028268113219",
"230271682951812931991217875473602171340",
"163676601131796811240853319991152359208",
"200371280431240011775913715819151853889",
"78850416052757969437142691144033413107",
"283441175096289924288174297560996770652",
"80399396701022801230570079745502308421",
"151738374748891949487419315738010131523",
"85473842485298717907673490613915102957",
"180520422938937444518669893830442926689",
"197436076333945902810461376226683535948",
"125829118674456786209544398230868814979",
"290306739706245075628571628514506205837",
"270447036330343062542738753769631899063",
"201623699832595228429649740615522752965",
"176197214352863990909658907162327470831",
"115572443209617328295575408862586084728",
"52020091178367900186900034194766085568",
"135892142091976790040053832799064853343",
"194172168199868961431342296499440288180",
"283501750818869507713670729635463823605",
"35508667710854836396230074738720129772",
"168228883523315982890572996866914398281",
"174847223604876171502315192199328523871",
"288261371254888345346376316444865097638",
"288516662158115895069887963517689046514",
"44619485569779683981807040101252742201",
"329788470509232646728294715517991069821",
"267811146716476021340765291342723878012",
"336376176148648431640554060248088048546",
"184149494695944815898520453826099474740",
"107186798974721528188993410529460402970",
"259430091548050370480008464869482709375"
]
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76",
"signature_type": "Line",
"target": {
"file": "kernel/time/posix-timers.c"
}
},
{
"id": "CVE-2018-12896-75773abc",
"signature_version": "v1",
"digest": {
"function_hash": "236085400592294588209546954528709938341",
"length": 439.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76",
"signature_type": "Function",
"target": {
"file": "kernel/time/posix-timers.c",
"function": "posixtimer_rearm"
}
},
{
"id": "CVE-2018-12896-7d9fbdde",
"signature_version": "v1",
"digest": {
"function_hash": "280956218012416674224360632768002112411",
"length": 1619.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76",
"signature_type": "Function",
"target": {
"file": "kernel/time/posix-timers.c",
"function": "do_timer_create"
}
},
{
"id": "CVE-2018-12896-85879a4d",
"signature_version": "v1",
"digest": {
"function_hash": "339949508028308134372832372927539693015",
"length": 709.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76",
"signature_type": "Function",
"target": {
"file": "kernel/time/posix-timers.c",
"function": "common_timer_get"
}
},
{
"id": "CVE-2018-12896-85fd06d7",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"292525619461716687355863334898740645420",
"232228245603791600699792271748953188878",
"334350742108248097167244249919962835212",
"10470993497216544244215183174136044603",
"88750299166975156350515632596685947927"
]
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76",
"signature_type": "Line",
"target": {
"file": "include/linux/posix-timers.h"
}
},
{
"id": "CVE-2018-12896-8d78eea3",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161999707263154274706565526590521668110",
"6542059301274459544384634894977823087",
"118405530293422808162009904058868234923",
"182527382648643014701340088123053880354"
]
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76",
"signature_type": "Line",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
}
},
{
"id": "CVE-2018-12896-f1201ead",
"signature_version": "v1",
"digest": {
"function_hash": "46254973314291476133517244706670863776",
"length": 482.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76",
"signature_type": "Function",
"target": {
"file": "kernel/time/posix-cpu-timers.c",
"function": "bump_cpu_timer"
}
},
{
"id": "CVE-2018-12896-fef6e724",
"signature_version": "v1",
"digest": {
"function_hash": "153791653160773798006821421596376140573",
"length": 758.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76",
"signature_type": "Function",
"target": {
"file": "kernel/time/posix-timers.c",
"function": "posix_timer_fn"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12896.json"