Vulnetix
Try Vulnetix Request Demo
CVE-2018-16882 PUBLISHED

A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before 4.14.91 and before 4.19.13 are vulnerable.

EPSS 0.10% · 27.9th percentile

Risk Scores

EPSS Score
0.10%
27.9th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSlinux-hwe0, 4.15.0-43.46~16.04.1, 4.15.0-42.45~16.04.1
Ubuntu:18.04:LTSlinux4.15.0-30.32, 4.15.0-43.46, 4.15.0-42.45
Ubuntu:18.04:LTSlinux-gcp4.15.0-1003.3, 4.15.0-1001.1, 0
Ubuntu:16.04:LTSlinux-azure4.13.0-1012.15, 4.13.0-1011.14, 4.13.0-1009.12
Ubuntu:18.04:LTSlinux-gcp-edge4.18.0-1005.6~18.04.1, 4.18.0-1004.5~18.04.1, 0
Ubuntu:18.04:LTSlinux-oem4.15.0-1012.15, 0, 4.15.0-1002.3
Ubuntu:18.04:LTSlinux-hwe0, 4.18.0-13.14~18.04.1
Ubuntu:18.04:LTSlinux-oracle4.15.0-1007.9, 0
Ubuntu:14.04:LTSlinux-azure4.15.0-1036.38~14.04.2, 0, 4.15.0-1023.24~14.04.1
Ubuntu:18.04:LTSlinux-raspi24.15.0-1009.10, 4.15.0-1029.31, 4.15.0-1028.30
Ubuntu:16.04:LTSlinux-oracle0, 4.15.0-1007.9~16.04.1
Ubuntu:18.04:LTSlinux-kvm4.15.0-1020.20, 0, 4.15.0-1002.2
Ubuntu:16.04:LTSlinux-gcp4.15.0-1014.14~16.04.1, 4.13.0-1019.23, 4.13.0-1017.21
Ubuntu:16.04:LTSlinux-aws-hwe4.15.0-1031.33~16.04.1, 4.15.0-1030.31~16.04.1, 0
Ubuntu:18.04:LTSlinux-aws0, 4.15.0-1031.33, 4.15.0-1029.30
Ubuntu:18.04:LTSlinux-azure4.15.0-1014.14, 4.15.0-1018.18, 4.15.0-1019.19

Timeline

References

Open in Interactive Console →