CVE-2018-1000199

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.

To mitigate this issue:
1) Save the following script in a 'CVE-2018-1000199.stp' file.
---
probe kernel.function("ptrace_set_debugreg") {
        if ($n < 4)
            $n = 4; /* set invalid debug register #, returns -EIO */
}
probe begin {
        printk(0, "CVE-2018-1000199 mitigation loaded")
}
probe end {
        printk(0, "CVE-2018-1000199 mitigation unloaded")
}
---
2) Install systemtap package and its dependencies
     # yum install -y systemtap systemtap-runtime
     # yum install -y kernel-devel kernel-debuginfo kernel-debuginfo-common

3) Build the mitigation kernel module as root.
    # stap -r `uname -r` -m cve_2018_1000199.ko -g CVE-2018-1000199.stp -p4

4) Load the mitigation module as root
    # staprun -L cve_2018_1000199.ko