CVE-2018-20855: An issue was discovered in the Linux kernel before 4.18.7

Low severity · published Jul 26, 2019

CVE-2018-20855

An issue was discovered in the Linux kernel before 4.18.7

3.3

CVSS

0.5%

EPSS

On KEV

Description

An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 40% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Kernel · Linux

before 4.18.7 · source: NVD

Active IQ Performance Analytics Services · Netapp

All versions, or not specified · source: NVD

Active IQ Unified Manager · Netapp

9.5 and later · source: NVD

Data Availability Services · Netapp

All versions, or not specified · source: NVD

Element Software · Netapp

All versions, or not specified · source: NVD

Leap · Opensuse

15.0; 15.1 · source: NVD

Affected product

Kernel

Linux

All Kernel CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-20855

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-20855

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html

Mailing List

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.7

Mailing List

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0625b4ba1a5d4703c7fb01c497bd6c156908af00

Patch

https://github.com/torvalds/linux/commit/0625b4ba1a5d4703c7fb01c497bd6c156908af00

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190905-0002/