CVE-2017-18232

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-03-15 · updated 2026-06-17

Description

The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within libsas, which allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.

Affected products

Linux kernel: through 4.15.9

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0558f33c06bb910e2879e355192227a8e8f0219d
http://www.securityfocus.com/bid/103423
https://access.redhat.com/errata/RHSA-2018:3083
https://access.redhat.com/errata/RHSA-2018:3096
https://github.com/torvalds/linux/commit/0558f33c06bb910e2879e355192227a8e8f0219d
https://usn.ubuntu.com/4163-1/
https://usn.ubuntu.com/4163-2/
https://www.debian.org/security/2018/dsa-4187
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0558f33c06bb910e2879e355192227a8e8f0219d
http://www.securityfocus.com/bid/103423
https://access.redhat.com/errata/RHSA-2018:3083
https://access.redhat.com/errata/RHSA-2018:3096

Get alerted when CVE-2017-18232 or the next vulnerability affects your stack