Vulnetix
Try Vulnetix Request Demo
CVE-2018-18281 PUBLISHED

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.

EPSS 0.42% · 61.9th percentile

Risk Scores

EPSS Score
0.42%
61.9th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSlinux-azure0, 4.15.0-1032.33~14.04.2, 4.15.0-1031.32~14.04.1
Ubuntu:Pro:FIPS:16.04:LTSlinux-fips4.4.0-1006.6, 0, 4.4.0-1003.3
Ubuntu:16.04:LTSlinux4.4.0-128.154, 4.4.0-127.153, 4.4.0-124.148
Ubuntu:22.04:LTSlinux-intel-iot-realtime0, 5.15.0-1073.75
Ubuntu:16.04:LTSlinux-aws-hwe4.15.0-1031.33~16.04.1, 4.15.0-1030.31~16.04.1, 0
Ubuntu:18.04:LTSlinux4.15.0-42.45, 4.15.0-43.46, 4.15.0-32.35
Ubuntu:14.04:LTSlinux3.13.0-142.191, 3.13.0-143.192, 3.13.0-145.194
Ubuntu:16.04:LTSlinux-snapdragon4.4.0-1039.43, 4.4.0-1044.48, 4.4.0-1046.50
Ubuntu:18.04:LTSlinux-oem4.15.0-1028.33, 4.15.0-1030.35, 0
Ubuntu:16.04:LTSlinux-gcp4.10.0-1009.9, 0, 4.10.0-1004.4
Ubuntu:24.04:LTSlinux-raspi-realtime0, 6.8.0-2019.20
Ubuntu:22.04:LTSlinux-realtime0, 5.15.0-1032.35
Ubuntu:16.04:LTSlinux-raspi24.4.0-1010.12, 4.4.0-1010.13, 4.4.0-1012.16
Ubuntu:14.04:LTSlinux-aws4.4.0-1024.25, 4.4.0-1028.31, 0
Ubuntu:18.04:LTSlinux-kvm4.15.0-1011.11, 4.15.0-1010.10, 4.15.0-1008.8
Ubuntu:18.04:LTSlinux-raspi24.15.0-1017.18, 4.15.0-1020.22, 4.15.0-1018.19
Ubuntu:18.04:LTSlinux-aws4.15.0-1009.9, 4.15.0-1031.33, 4.15.0-1029.30
Ubuntu:22.04:LTSlinux-riscv0, 5.15.0-1026.30, 5.15.0-1023.27
Ubuntu:14.04:LTSlinux-lts-xenial4.4.0-62.83~14.04.1, 4.4.0-127.153~14.04.1, 4.4.0-124.148~14.04.1
Ubuntu:16.04:LTSlinux-azure4.13.0-1016.19, 4.15.0-1030.31~16.04.1, 4.15.0-1028.29~16.04.1

…and 7 more

Timeline

References

Open in Interactive Console →