PT-2019-10283 · Linux+2 · Linux Kernel+2

Published 2018-09-17 · Updated 2019-11-20 · CVE-2018-20855

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.18.7

Description: An issue was discovered in the Linux kernel where mlx5 ib create qp resp was never initialized in create qp common in drivers/infiniband/hw/mlx5/qp.c, resulting in a leak of stack memory to userspace.

Recommendations: For Linux kernel versions prior to 4.18.7, update to version 4.18.7 or later to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2018-2333

ALT-PU-2018-2336

ALT-PU-2019-1433

CVE-2018-20855

OPENSUSE-SU-2019:1923-1

OPENSUSE-SU-2019:1924-1

OPENSUSE-SU-2019_1923-1

OPENSUSE-SU-2019_1924-1

SUSE-SU-2019:14157-1

SUSE-SU-2019:2068-1

SUSE-SU-2019:2069-1

SUSE-SU-2019:2070-1

SUSE-SU-2019:2071-1

SUSE-SU-2019:2072-1

SUSE-SU-2019:2073-1

SUSE-SU-2019:2262-1

SUSE-SU-2019:2263-1

SUSE-SU-2019:2299-1

SUSE-SU-2019:2430-1

SUSE-SU-2019:2450-1

SUSE-SU-2019_14157-1

SUSE-SU-2019_2068-1

SUSE-SU-2019_2070-1

SUSE-SU-2019_2071-1

SUSE-SU-2019_2072-1

SUSE-SU-2019_2073-1

SUSE-SU-2019_2262-1

Affected Products

Alt Linux

Linux Kernel

Suse

References · 698

• https://github.com/torvalds/linux/commit/0625b4ba1a5d4703c7fb01c497bd6c156908af00 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2019:2299-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14157-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2073-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2430-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1924-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-20855 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1923-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-20855 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2450-1 · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20855 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2070-1 · Vendor Advisory