Medium severity · published Apr 24, 2018
CVE-2018-1059
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host…
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
CVSS vector
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Ceph Storage · Redhat
3.0 · source: NVD
DP
Data Plane Development Kit · Dpdk
before 18.02.1 · source: NVD
EL
Enterprise Linux · Redhat
7.0 · source: NVD
EL
Enterprise Linux Fast Datapath · Redhat
7.0 · source: NVD
OP
Openshift · Redhat
3.0 · source: NVD
OP
Openstack · Redhat
8; 9; 10; 11; 12 · source: NVD
UL
Ubuntu Linux · Canonical
17.10; 18.04 · source: NVD
VI
Virtualization · Redhat
4.0; 4.1 · source: NVD
VM
Virtualization Manager · Redhat
4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1059
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1059
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1267
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:2038
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:2102
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:2524
Third Party Advisory
https://access.redhat.com/security/cve/cve-2018-1059
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1544298
More from Ubuntu Linux
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation