CVE-2018-1059

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1544298	Issue Tracking Third Party Advisory
https://access.redhat.com/security/cve/cve-2018-1059	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1267	Third Party Advisory
https://usn.ubuntu.com/3642-1/	Third Party Advisory
https://usn.ubuntu.com/3642-2/	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2038
https://access.redhat.com/errata/RHSA-2018:2102
https://access.redhat.com/errata/RHSA-2018:2524

Configuration 1

cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift:3.0:*:*:*:enterprise:*:*:* cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:enterprise_linux_fast_datapath:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization_manager:4.1:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization:4.1:*:*:*:*:*:*:* cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:11:*:*:*:*:*:*:* cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:*

---

Published : 2018-04-24 06:29

Updated : 2021-08-04 05:15

---

NVD link : CVE-2018-1059

Mitre link : CVE-2018-1059

No products.

CWE-200