PT-2018-3627 · Linux+5 · Linux Kernel+5
Published
2018-05-09
·
Updated
2024-06-15
·
CVE-2018-1118
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions 4.8 and later
Description
The issue is related to the
vhost new msg() function in the Linux kernel, which can lead to information disclosure. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file. The problem arises because the Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system.Recommendations
For Linux kernel versions 4.8 and later, consider restricting access to the
/dev/vhost-net device file to minimize the risk of exploitation. As a temporary workaround, consider disabling the vhost new msg() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Improper Initialization
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu