CVE-2018-12896

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.17.3

Description The issue is related to an Integer Overflow in the POSIX timer code, specifically in kernel/time/posix-timers.c. This overflow occurs due to the way overrun accounting works, where the overrun can exceed INT MAX, but the accounting is based on integers. As a result, the accounting values visible to user space via timer getoverrun(2) and siginfo::si overrun can appear random. A local user can potentially cause a denial of service (signed integer overflow) by crafting specific system calls, including mmap, futex, timer create, and timer settime.

Recommendations For Linux kernel versions prior to 4.17.3, update to a version 4.17.3 or later to resolve the issue.