CVE-2018-14625
kernel: use-after-free Read in vhost_transport_send_pkt
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients.
Se ha detectado un error en el kernel de Linux en el que un atacante podría ser capaz de tener una lectura no controlada de la memoria del kernel desde dentro de una máquina virtual invitada. Una condición de carrera entre las funciones connect() y close() podría permitir que un atacante que emplee el protocolo AF_VSOCK reúna una filtración de información de 4 bytes o, posiblemente, intercepte o corrompa mensajes AF_VSOCK destinados a otros clientes
A flaw was found where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly impersonate AF_VSOCK messages destined to other clients or leak kernel memory.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-07-27 CVE Reserved
- 2018-09-10 CVE Published
- 2023-09-04 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CWE-416: Use After Free
CAPEC
References (15)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html | Mailing List |
|
| https://syzkaller.appspot.com/bug?extid=bd391451452fb0b93039 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14625 | 2023-02-13 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2019:2029 | 2023-02-13 | |
| https://access.redhat.com/errata/RHSA-2019:2043 | 2023-02-13 | |
| https://access.redhat.com/errata/RHSA-2019:4154 | 2023-02-13 | |
| https://usn.ubuntu.com/3871-1 | 2023-02-13 | |
| https://usn.ubuntu.com/3871-3 | 2023-02-13 | |
| https://usn.ubuntu.com/3871-4 | 2023-02-13 | |
| https://usn.ubuntu.com/3871-5 | 2023-02-13 | |
| https://usn.ubuntu.com/3872-1 | 2023-02-13 | |
| https://usn.ubuntu.com/3878-1 | 2023-02-13 | |
| https://usn.ubuntu.com/3878-2 | 2023-02-13 | |
| https://access.redhat.com/security/cve/CVE-2018-14625 | 2019-12-10 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1619846 | 2019-12-10 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | - | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.10" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||