PT-2018-2961 · Linux+5 · Linux Kernel+5

Jann Horn · Published 2018-10-18 · Updated 2020-08-24 · CVE-2018-18281

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.9.135 Linux kernel versions prior to 4.14.78 Linux kernel versions prior to 4.18.16 Linux kernel versions prior to 4.19

Description The issue arises from the mremap() syscall in the Linux kernel, which can lead to a stale TLB entry remaining for a short time after a physical page has been released and reused. This can permit access to the physical page. The problem is due to insufficient input validation in the implementation of the mremap() syscall.

Recommendations For Linux kernel versions prior to 4.9.135, update to version 4.9.135 or later. For Linux kernel versions prior to 4.14.78, update to version 4.14.78 or later. For Linux kernel versions prior to 4.18.16, update to version 4.18.16 or later. For Linux kernel versions prior to 4.19, update to version 4.19 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-459

Related Identifiers

ALT-PU-2018-2524

ALT-PU-2018-2529

ALT-PU-2018-2586

ALT-PU-2018-2631

ALT-PU-2019-1433

BDU:2019-02783

CESA-2019_2029

CVE-2018-18281

DLA-1715-1

DLA-1731-1

DLA-1731-2

MGASA-2018-0417

MGASA-2018-0418

MGASA-2018-0419

OPENSUSE-SU-2018_3817-1

OPENSUSE-SU-2018_4133-1

RHSA-2019:0831

RHSA-2019:2029

RHSA-2019:2043

RHSA-2019_2029

RHSA-2019_2043

RHSA-2020:0036

RHSA-2020:0100

RHSA-2020:0103

RHSA-2020:0179

SUSE-SU-2018:3688-1

SUSE-SU-2018:3689-1

SUSE-SU-2018:3746-1

SUSE-SU-2018:3773-1

SUSE-SU-2018:3869-1

SUSE-SU-2018:4069-1

SUSE-SU-2018:4072-1

SUSE-SU-2019:0095-1

SUSE-SU-2019:0150-1

SUSE-SU-2019:0222-1

SUSE-SU-2019:0224-1

SUSE-SU-2019:0439-1

SUSE-SU-2019:1289-1

SUSE-SU-2019:13937-1

USN-3832-1

USN-3835-1

USN-3871-1

USN-3871-2

USN-3871-3

USN-3871-4

USN-3871-5

USN-3880-1

USN-3880-2

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 714

• 🔥 https://bugs.chromium.org/p/project-zero/issues/detail?id=1695 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2019:13937-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10882 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3880-2 · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.78 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3871-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3869-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0222-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3871-4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18281 · Vendor Advisory
• http://openwall.com/lists/oss-security/2018/10/29/5 · Patch
• https://osv.dev/vulnerability/USN-3871-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-18281 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0150-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3689-1 · Vendor Advisory