CVE-2018-18281

MEDIUM

Description

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.

References

http://packetstormsecurity.com/files/150001/Linux-mremap-TLB-Flush-Too-Late.html

http://www.openwall.com/lists/oss-security/2018/10/29/5

http://www.securityfocus.com/bid/105761

http://www.securityfocus.com/bid/106503

https://access.redhat.com/errata/RHSA-2019:0831

https://access.redhat.com/errata/RHSA-2019:2029

https://access.redhat.com/errata/RHSA-2019:2043

https://bugs.chromium.org/p/project-zero/issues/detail?id=1695

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.78

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.16

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.135

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eb66ae030829605d61fbef1909ce310e29f78821

https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html

https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html

https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html

https://usn.ubuntu.com/3832-1/

https://usn.ubuntu.com/3835-1/

https://usn.ubuntu.com/3871-1/

https://usn.ubuntu.com/3871-3/

https://usn.ubuntu.com/3871-4/

https://usn.ubuntu.com/3871-5/

https://usn.ubuntu.com/3880-1/

https://usn.ubuntu.com/3880-2/

Details

Source: MITRE

Published: 2018-10-30

Updated: 2019-04-23

Type: CWE-20

Risk Information

CVSS v2.0

Base Score: 4.6

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 3.9

Severity: MEDIUM

CVSS v3.0

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1.8

Severity: HIGH

Vulnerable Software

ID	Name	Product	Family	Severity
133164	RHEL 7 : kernel (RHSA-2020:0179)	Nessus	Red Hat Local Security Checks	medium
132947	RHEL 6 : kernel-rt (RHSA-2020:0100)	Nessus	Red Hat Local Security Checks	medium
132886	RHEL 7 : kernel (RHSA-2020:0103)	Nessus	Red Hat Local Security Checks	medium
132700	RHEL 7 : kernel (RHSA-2020:0036)	Nessus	Red Hat Local Security Checks	critical
132495	NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0253)	Nessus	NewStart CGSL Local Security Checks	critical
132474	NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel Multiple Vulnerabilities (NS-SA-2019-0247)	Nessus	NewStart CGSL Local Security Checks	critical
129920	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0183)	Nessus	NewStart CGSL Local Security Checks	critical
129900	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0180)	Nessus	NewStart CGSL Local Security Checks	critical
128651	CentOS 7 : kernel (CESA-2019:2029)	Nessus	CentOS Local Security Checks	high
128226	Scientific Linux Security Update : kernel on SL7.x x86_64	Nessus	Scientific Linux Local Security Checks	high
127655	RHEL 7 : kernel-rt (RHSA-2019:2043)	Nessus	Red Hat Local Security Checks	high
127650	RHEL 7 : kernel (RHSA-2019:2029)	Nessus	Red Hat Local Security Checks	high
125283	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1289-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	high
124975	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1522)	Nessus	Huawei Local Security Checks	high
124834	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1512)	Nessus	Huawei Local Security Checks	high
124257	RHEL 7 : kernel-alt (RHSA-2019:0831)	Nessus	Red Hat Local Security Checks	medium
123721	EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1253)	Nessus	Huawei Local Security Checks	medium
123712	EulerOS Virtualization 2.5.3 : kernel (EulerOS-SA-2019-1244)	Nessus	Huawei Local Security Checks	medium
123605	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-1131)	Nessus	Huawei Local Security Checks	high
123420	Debian DLA-1731-2 : linux regression update (Spectre)	Nessus	Debian Local Security Checks	high
123397	openSUSE Security Update : the Linux Kernel (openSUSE-2019-974)	Nessus	SuSE Local Security Checks	medium
123121	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-1108)	Nessus	Huawei Local Security Checks	high
122879	Debian DLA-1715-1 : linux-4.9 security update (Spectre)	Nessus	Debian Local Security Checks	high
122699	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1076)	Nessus	Huawei Local Security Checks	high
122343	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0439-1)	Nessus	SuSE Local Security Checks	high
122052	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : linux-azure vulnerabilities (USN-3871-5)	Nessus	Ubuntu Local Security Checks	high
121598	Ubuntu 14.04 LTS : linux vulnerabilities (USN-3880-1)	Nessus	Ubuntu Local Security Checks	high
121594	Ubuntu 16.04 LTS : linux-hwe, linux-aws-hwe, linux-gcp vulnerabilities (USN-3871-4)	Nessus	Ubuntu Local Security Checks	high
121593	Ubuntu 18.04 LTS : linux-aws, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities (USN-3871-3)	Nessus	Ubuntu Local Security Checks	high
121592	Ubuntu 18.04 LTS : linux regression (USN-3871-2)	Nessus	Ubuntu Local Security Checks	high
121571	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:0224-1)	Nessus	SuSE Local Security Checks	high
121569	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0222-1) (Spectre)	Nessus	SuSE Local Security Checks	high
121505	Slackware 14.2 : Slackware 14.2 kernel (SSA:2019-030-01)	Nessus	Slackware Local Security Checks	high
121469	Ubuntu 18.04 LTS : linux vulnerabilities (USN-3871-1)	Nessus	Ubuntu Local Security Checks	high
121468	SUSE SLES11 Security Update : kernel (SUSE-SU-2019:13937-1)	Nessus	SuSE Local Security Checks	high
121208	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0095-1)	Nessus	SuSE Local Security Checks	high
119708	openSUSE Security Update : the Linux Kernel (openSUSE-2018-1548)	Nessus	SuSE Local Security Checks	medium
119647	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:4069-1)	Nessus	SuSE Local Security Checks	high
119338	Ubuntu 18.10 : linux, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities (USN-3835-1)	Nessus	Ubuntu Local Security Checks	high
119302	Ubuntu 18.10 : linux-aws vulnerabilities (USN-3832-1)	Nessus	Ubuntu Local Security Checks	high
119077	openSUSE Security Update : the Linux Kernel (openSUSE-2018-1427)	Nessus	SuSE Local Security Checks	high
118952	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:3746-1)	Nessus	SuSE Local Security Checks	high
118882	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:3689-1)	Nessus	SuSE Local Security Checks	high