medium6.1
CVE-2018-1059
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addr…
Impact
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Canonical | Ubuntu Linux | Versions 17.10, 18.04 |
| Redhat | Ceph Storage | Version 3.0 |
| Redhat | Enterprise Linux Fast Datapath | Version 7.0 |
| Redhat | Openshift | Version 3.0 |
| Redhat | Openstack | Versions 8, 9, 10, 11, 12 |
| Redhat | Virtualization | Versions 4.0, 4.1 |
| Redhat | Virtualization Manager | Version 4.1 |
| Redhat | Enterprise Linux | Version 7.0 |
| Dpdk | Data Plane Development Kit | before 18.02.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://access.redhat.com/errata/RHSA-2018:1267
- https://access.redhat.com/errata/RHSA-2018:2038
- https://access.redhat.com/errata/RHSA-2018:2102
- https://access.redhat.com/errata/RHSA-2018:2524
- https://access.redhat.com/security/cve/cve-2018-1059
- https://bugzilla.redhat.com/show_bug.cgi?id=1544298
- https://usn.ubuntu.com/3642-1/
- https://usn.ubuntu.com/3642-2/
- https://access.redhat.com/errata/RHSA-2018:1267
- https://access.redhat.com/errata/RHSA-2018:2038
- https://access.redhat.com/errata/RHSA-2018:2102
- https://access.redhat.com/errata/RHSA-2018:2524
- https://access.redhat.com/security/cve/cve-2018-1059
- https://bugzilla.redhat.com/show_bug.cgi?id=1544298
- https://usn.ubuntu.com/3642-1/
- https://usn.ubuntu.com/3642-2/