NetSight
IP …
high7.8

CVE-2018-18281

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks.

Impact

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.2 before 4.9.135
from 4.9.136 before 4.14.78
from 4.14.79 before 4.18.16
from 4.18.17 before 4.19
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 18.10
DebianDebian Linux
Version 8.0

Weakness classification

CWE-459

References