CVE-2018-14656

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrary kernel address into the dmesg log.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
[UNKNOWN]	kernel	n/a

References

http://www.securitytracker.com/id/1041804Third Party Advisory, VDB Entry
https://bugs.chromium.org/p/project-zero/issues/detail?id=1650Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14656Issue Tracking, Patch, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=342db04ae71273322f0011384a9ed414df8bdae4Patch, Third Party Advisory
https://lore.kernel.org/lkml/20180828154901.112726-1-jannh%40google.com/T/
https://seclists.org/oss-sec/2018/q4/9Mailing List, Patch, Third Party Advisory
http://www.securitytracker.com/id/1041804Third Party Advisory, VDB Entry
https://bugs.chromium.org/p/project-zero/issues/detail?id=1650Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14656Issue Tracking, Patch, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=342db04ae71273322f0011384a9ed414df8bdae4Patch, Third Party Advisory
https://lore.kernel.org/lkml/20180828154901.112726-1-jannh%40google.com/T/
https://seclists.org/oss-sec/2018/q4/9Mailing List, Patch, Third Party Advisory

Timeline

Published: Oct 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-146578.1A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm CVE-2018-146586.1A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.CVE-2018-146596.5The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_K CVE-2018-14665.3IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, CVE-2018-146606.5A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, auth CVE-2018-146616.5It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage,CVE-2018-146625.7It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used CVE-2018-146635.9An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the ad CVE-2018-146645.4A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in CVE-2018-146656.6A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X CVE-2018-146667.2An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host r CVE-2018-146679.8The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unaut