PT-2018-3624 · Linux+5 · Linux Kernel+5

Nadav Amit · Published 2018-08-20 · Updated 2019-10-03 · CVE-2018-15594

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.18.1

Description The issue is related to the mishandling of certain indirect calls in the arch/x86/kernel/paravirt.c file, making it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests. This can potentially allow an attacker to access confidential data.

Recommendations For Linux kernel versions prior to 4.18.1, update to version 4.18.1 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2018-2192

ALT-PU-2018-2210

ALT-PU-2019-1433

BDU:2021-01417

CESA-2019_2029

CVE-2018-15594

DLA-1529-1

DLA-1531-1

DSA-4308-1

OPENSUSE-SU-2019_1407-1

RHSA-2019:2029

RHSA-2019:2043

RHSA-2019_2029

RHSA-2019_2043

SUSE-SU-2018:2879-1

SUSE-SU-2018:3084-1

SUSE-SU-2018:3088-1

SUSE-SU-2019:1245-1

USN-3775-1

USN-3775-2

USN-3776-1

USN-3776-2

USN-3777-1

USN-3777-2

USN-3777-3

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 273

• https://github.com/torvalds/linux/commit/5800dc5c19f34e6e03b5adab1282535cb102fafd · Patch
• https://usn.ubuntu.com/3776-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14634 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2043 · Vendor Advisory
• https://usn.ubuntu.com/3775-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3777-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-3639 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-6555 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3776-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10902 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17182 · Vendor Advisory
• https://usn.ubuntu.com/3777-3 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3776-1 · Vendor Advisory
• https://usn.ubuntu.com/3777-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5715 · Vendor Advisory