CVEvulnerability

CVE-2018-1059

6.1 MEDIUM Published 2018-04-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-04-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.1 MEDIUM — CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.9 LOW — AV:A/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

Affected configurations

• canonical ubuntu linux 17.10 • canonical ubuntu linux 18.04 • redhat ceph storage 3.0 • redhat enterprise linux fast datapath 7.0 • redhat openshift 3.0 • redhat openstack 8 • redhat openstack 9 • redhat openstack 10 • redhat openstack 11 • redhat openstack 12 • redhat virtualization 4.0 • redhat virtualization 4.1 • redhat virtualization manager 4.1 • redhat enterprise linux 7.0 • dpdk data plane development kit (< 18.02.1)

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References