CVE-2018-10689

Name	CVE-2018-10689
Description	blktrace (aka Block IO Tracing) 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the dev_map_read function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	897695

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
blktrace (PTS)	bookworm, bullseye	1.2.0-5	fixed
	sid, trixie	1.3.0-0.2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
blktrace	source	jessie	1.0.5-1+deb8u1
blktrace	source	stretch	1.1.0-2+deb9u1
blktrace	source	(unstable)	1.2.0-1	low	897695

Notes

[wheezy] - blktrace <no-dsa> (Minor issue)
https://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git/commit/?id=d61ff409cb4dda31386373d706ea0cfb1aaac5b7
https://www.spinics.net/lists/linux-btrace/msg00847.html