CVE-2018-10902

State: Published
Severity: 7.8 High
Published: Aug 21, 2018
Updated: Jul 7, 2026
Reserved: May 9, 2018

Description

It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation.

Scores

CVSS	Score	Vector	Source
3.0	7.8 High	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-416

Affected Products

Product	Versions
LinuxLinux	3.16.58 to before 3.16.Not affected 3.18.117 to before 3.18.Not affected 4.4.144 to before 4.4.Not affected 4.9.115 to before 4.9.Not affected 4.14.100 to before 4.14.Not affected 4.17.10 to before 4.17.Not affected 4.18 and laterNot affected

References

RHSA-2018:3083vendor-advisory
USN-3776-1vendor-advisory
USN-3776-2vendor-advisory
USN-3847-1vendor-advisory
[debian-lts-announce] 20181003 [SECURITY] [DLA 1531-1] linux-4.9 security updatemailing-list
USN-3847-2vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10902
USN-3849-1vendor-advisory
RHSA-2019:0415vendor-advisory
USN-3849-2vendor-advisory
1041529vdb-entry
DSA-4308vendor-advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=39675f7a7c7e7702f7d5341f1e0d01db746543a0
USN-3847-3vendor-advisory
RHSA-2018:3096vendor-advisory
105119vdb-entry
RHSA-2019:0641vendor-advisory
RHSA-2019:3217vendor-advisory
RHSA-2019:3967vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.