Use After Free in Linux Kernel
CVE-2018-16882
A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before 4.14.91 and before 4.19.13 are vulnerable.
Vulnerability class: Use-After-Free
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (27.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 27.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Linux Kernel
- The Linux Foundation Kernel: — versions before 4.14.91, before 4.19.13
- Canonical Ubuntu Linux — versions 14.04, 16.04, 18.04
Weakness classification (CWE)
References
- marc.info/ (Patch, Third Party Advisory)
- usn.ubuntu.com/3872-1/ (vendor-advisory, Third Party Advisory)
- usn.ubuntu.com/3878-1/ (vendor-advisory, Third Party Advisory)
- usn.ubuntu.com/3871-5/ (vendor-advisory, Third Party Advisory)
- usn.ubuntu.com/3878-2/ (vendor-advisory, Third Party Advisory)
- usn.ubuntu.com/3871-4/ (vendor-advisory, Third Party Advisory)
- www.securityfocus.com/bid/106254 (VDB Entry, Third Party Advisory, vdb-entry)
- lwn.net/Articles/775720/ (Third Party Advisory)
- usn.ubuntu.com/3871-1/ (vendor-advisory, Third Party Advisory)
- lwn.net/Articles/775721/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2018-16882?
- CVE-2018-16882 is a high-severity vulnerability in Linux Kernel, classified under Use After Free. CVSS score: 8.8/10. Published 2019-01-03.
- How severe is CVE-2018-16882?
- High severity. CVSS v3 base score is 8.8 out of 10.