CVE-2018-7191

In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice

published May 17, 2019

CVSS
—
EPSS
1%
Percentile
50.4
In the wild
Unconfirmed
What it is

In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00654 · 50.4th percentile
Published
2019-05-17T04:27Z
EPSS history
Timeline
  • 17 MAY 04:27Z
    In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice
    cvelistv5