CVE-2018-11412

In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode.

• CWE-416

• http://www.securityfocus.com/bid/104291Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:0525Third Party Advisory
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1580Exploit, Third Party Advisory
• https://bugzilla.kernel.org/show_bug.cgi?id=199803Exploit, Issue Tracking, Third Party Advisory
• https://usn.ubuntu.com/3752-1/Third Party Advisory
• https://usn.ubuntu.com/3752-2/Third Party Advisory
• https://usn.ubuntu.com/3752-3/Third Party Advisory
• https://www.exploit-db.com/exploits/44832/Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/104291Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:0525Third Party Advisory
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1580Exploit, Third Party Advisory
• https://bugzilla.kernel.org/show_bug.cgi?id=199803Exploit, Issue Tracking, Third Party Advisory
• https://usn.ubuntu.com/3752-1/Third Party Advisory
• https://usn.ubuntu.com/3752-2/Third Party Advisory
• https://usn.ubuntu.com/3752-3/Third Party Advisory
• https://www.exploit-db.com/exploits/44832/Exploit, Third Party Advisory, VDB Entry

Published

May 24, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-11407An issue was discovered in the Ldap component in Symfony 2.8…
• CVE-2018-11408The security handlers in the Security component in Symfony i…
• CVE-2018-11409Splunk through 7.0.1 allows information disclosure by append…
• CVE-2018-1141When installing Nessus to a directory outside of the default…
• CVE-2018-11410An issue was discovered in Liblouis 3.5.0. A invalid free in…
• CVE-2018-11411The transferFrom function of a smart contract implementation…
• CVE-2018-11413An issue was discovered in BearAdmin 0.5. Remote attackers c…
• CVE-2018-11414An issue was discovered in BearAdmin 0.5. There is admin/adm…
• CVE-2018-11415SAP Internet Transaction Server (ITS) 6200.X.X has Reflected…
• CVE-2018-11416jpegoptim.c in jpegoptim 1.4.5 (fixed in 1.4.6) has an inval…
• CVE-2018-11418An issue was discovered in JerryScript 1.0. There is a heap-…
• CVE-2018-11419An issue was discovered in JerryScript 1.0. There is a heap-…