CVE-2018-14617

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-07-27 · updated 2026-06-17
Weakness: CWE-476

Description

An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04
Debian Linux: 8.0, 9.0
Linux kernel: through 4.17.10

References

http://www.securityfocus.com/bid/104917
https://bugzilla.kernel.org/show_bug.cgi?id=200297
https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html
https://usn.ubuntu.com/3821-1/
https://usn.ubuntu.com/3821-2/
https://usn.ubuntu.com/4094-1/
https://usn.ubuntu.com/4118-1/
https://www.debian.org/security/2018/dsa-4308
https://www.spinics.net/lists/linux-fsdevel/msg130021.html
http://www.securityfocus.com/bid/104917
https://bugzilla.kernel.org/show_bug.cgi?id=200297
https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html

Get alerted when CVE-2018-14617 or the next vulnerability affects your stack