CVE-2018-1130

What it actually does

Null pointer dereference in dccp_write_xmit() in net/dccp/output.c triggered by specific crafted system calls, resulting in local denial of service via kernel crash.

Why it matters to the business

Local users can cause system crashes leading to unplanned downtime and service interruption on affected Linux systems; low exploit prevalence and absence from known campaigns reduce immediate risk but patching remains necessary for stability.

How an attack unfolds

An attacker with local access crafts and executes specific system calls involving DCCP sockets to reach the vulnerable code path in dccp_write_xmit(), dereferencing a null pointer and forcing a kernel panic or oops.

How to fix it

Upgrade the Linux kernel to a version containing commit 67f93df79aeefc3add4e4b31a752600f834236e2 or later; apply vendor-supplied kernel updates that address the dccp output handling flaw.

How to confirm the fix worked

Verify running kernel version is at or beyond the fixed commit; attempt reproduction of the triggering system calls in a controlled environment and confirm absence of kernel oops or panic; review kernel changelog for the referenced commit.

Typical attack path

1. Obtain local shell or process execution on target system
2. Create DCCP socket and issue sequence of crafted system calls targeting output path
3. Trigger null dereference causing kernel crash or reboot

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for null pointer dereference messages referencing dccp_write_xmit or net/dccp/output.c; correlate with process activity creating DCCP sockets around crash timestamps.

• dccp_write_xmit
• net/dccp/output.c
• BUG: unable to handle kernel NULL pointer dereference
• RIP: dccp_write_xmit

What your security team should do

• Prioritize kernel updates to include commit 67f93df79aeefc3add4e4b31a752600f834236e2 across all Linux deployments
• Limit local user privileges and restrict DCCP socket creation where feasible via seccomp or capabilities
• Monitor kernel logs for dccp-related null pointer dereference events during the update window