CVE-2018-16880
published 2019-01-29CVE-2018-16880: A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an…
PriorityP432high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.56%
43.5th percentile
A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 4.19.20-1 (bookworm) | linux 4.19.20-1 (bookworm) |
| linux | linux_kernel | >= 0 < 4.19.20-1 | 4.19.20-1 |
| linux | linux_kernel | >= 0 < 4.19.20-1 | 4.19.20-1 |
| linux | linux_kernel | >= 0 < 4.19.20-1 | 4.19.20-1 |
| linux | linux_kernel | >= 0 < 4.19.20-1 | 4.19.20-1 |
| linux | linux_kernel | >= 4.16 < 4.19.20 | 4.19.20 |
| linux | linux_kernel | >= 4.20 < 4.20.7 | 4.20.7 |
| msrc | cbl2_kernel_5.10.78.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_kernel_5.10.60.1-1_on_cbl_mariner_1.0 | — | — |
| the_linux_foundation | kernel | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.05.9MEDIUMCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.0HIGH
vendor_debian7.0HIGH
vendor_msrc7.0HIGH
vendor_redhat7.0HIGH
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x3fm-32v3-x7hm: A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver
ghsa_unreviewed·2022-05-14
CVE-2018-16880 [HIGH] CWE-787 GHSA-x3fm-32v3-x7hm: A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver
A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.
OSV
linux-hwe, linux-azure vulnerabilities
osv·2019-03-06·CVSS 7.0
[HIGH] linux-hwe, linux-azure vulnerabilities
linux-hwe, linux-azure vulnerabilities
USN-3903-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS.
Jason Wang discovered that the vhost net driver in the Linux kernel
contained an out of bounds write vulnerability. An attacker in a guest
virtual machine could use this to cause a denial of service (host system
crash) or possibly execute arbitrary code in the host kernel.
(CVE-2018-16880)
Jann Horn discovered that the userfaultd implementation in the Linux kernel
did not properly restrict access to certain ioctls. A local attacker could
use this possibly to modify files. (CVE-2018-18397)
Jann Horn discovered a race condition in the fork() system
OSV
CVE-2018-16880: A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver
osv·2019-01-29·CVSS 7.0
CVE-2018-16880 [HIGH] CVE-2018-16880: A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver
A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.
Kernel
vhost: fix OOB in get_rx_bufs()
kernel_security·2019-01-28·CVSS 7.0
CVE-2018-16880 [HIGH] vhost: fix OOB in get_rx_bufs()
vhost: fix OOB in get_rx_bufs()
After batched used ring updating was introduced in commit e2b3b35eb989
("vhost_net: batch used ring update in rx"). We tend to batch heads in
vq->heads for more than one packet. But the quota passed to
get_rx_bufs() was not correctly limited, which can result a OOB write
in vq->heads.
headcount = get_rx_bufs(vq, vq->heads + nvq->done_idx,
vhost_len, &in, vq_log, &log,
likely(mergeable) ? UIO_MAXIOV : 1);
UIO_MAXIOV was still used which is wrong since we could have batched
used in vq->heads, this will cause OOB if the next buffer needs more
than 960 (1024 (UIO_MAXIOV) - 64 (VHOST_NET_BATCH)) heads after we've
batched 64 (VHOST_NET_BATCH) heads:
Acked-by: Stefan Hajnoczi
BUG kmalloc-8k (Tainted: G B ): Redzone overwritten
INFO: 0x00000000fd93b7a2-0x000000
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2019-03-06·CVSS 7.0
CVE-2018-16880 [HIGH] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3903-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS.
Jason Wang discovered that the vhost net driver in the Linux kernel
contained an out of bounds write vulnerability. An attacker in a guest
virtual machine could use this to cause a denial of service (host system
crash) or possibly execute arbitrary code in the host kernel.
(CVE-2018-16880)
Jann Horn discovered that the userfaultd implementation in the Linux kernel
did not properly restrict access to certain ioctls. A local attacker could
use this possibly to modify files. (CVE-20
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-03-06·CVSS 7.0
CVE-2018-16880 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Jason Wang discovered that the vhost net driver in the Linux kernel
contained an out of bounds write vulnerability. An attacker in a guest
virtual machine could use this to cause a denial of service (host system
crash) or possibly execute arbitrary code in the host kernel.
(CVE-2018-16880)
Jann Horn discovered that the userfaultd implementation in the Linux kernel
did not properly restrict access to certain ioctls. A local attacker could
use this possibly to modify files. (CVE-2018-18397)
Jann Horn discovered a race condition in the fork() system call in the
Linux kernel. A local attacker could use this to gain access to services
that cache authorizations. (CVE-2019-6133)
Instructions:
Red Hat
kernel: Out of bounds write in get_rx_bufs() function in drivers/vhost/net.c
vendor_redhat·2019-01-25·CVSS 7.0
CVE-2018-16880 [HIGH] CWE-787 kernel: Out of bounds write in get_rx_bufs() function in drivers/vhost/net.c
kernel: Out of bounds write in get_rx_bufs() function in drivers/vhost/net.c
A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.
A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privile
Microsoft
A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest under specific conditions can trigger an out-of-bounds write in a kmalloc-8 slab on a v
vendor_msrc·2019-01-08·CVSS 7.0
CVE-2018-16880 [HIGH] CWE-787 A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest under specific conditions can trigger an out-of-bounds write in a kmalloc-8 slab on a v
A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest under specific conditions can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is commi
Debian
CVE-2018-16880: linux - A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] d...
vendor_debian·2018·CVSS 7.0
CVE-2018-16880 [HIGH] CVE-2018-16880: linux - A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] d...
A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.
Scope: local
bookworm: resolved (fixed in 4.19.20-1)
bullseye: resolved (fixed in 4.19.20-1)
forky: resolved (fixed in 4.19.20-1)
sid: resolved (fixed in 4.19.20-1)
trixie: resolved (fixed in 4.19.20-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-16880 kernel: Out of bounds write in get_rx_bufs() function in drivers/vhost/net.c [fedora-all]
bugzilla·2019-01-25·CVSS 7.0
CVE-2018-16880 [HIGH] CVE-2018-16880 kernel: Out of bounds write in get_rx_bufs() function in drivers/vhost/net.c [fedora-all]
CVE-2018-16880 kernel: Out of bounds write in get_rx_bufs() function in drivers/vhost/net.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2018-16880 kernel: Out of bounds write in get_rx_bufs() function in drivers/vhost/net.c
bugzilla·2018-12-05·CVSS 7.0
CVE-2018-16880 [HIGH] CVE-2018-16880 kernel: Out of bounds write in get_rx_bufs() function in drivers/vhost/net.c
CVE-2018-16880 kernel: Out of bounds write in get_rx_bufs() function in drivers/vhost/net.c
A flaw was found in the Linux kernel in the handle_rx() function in the [vhost_net] driver. A malicious virtual guest under specific conditions can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
References:
https://seclists.org/oss-sec/2019/q1/94
Introducing commits:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e2b3b35eb9896f26c98b9a2c047d9111638059a2
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f5a4941aa6d190e676065e8f4ed35999f52
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00037.htmlhttp://www.securityfocus.com/bid/106735https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16880https://support.f5.com/csp/article/K03593314https://usn.ubuntu.com/3903-1/https://usn.ubuntu.com/3903-2/http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00037.htmlhttp://www.securityfocus.com/bid/106735https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16880https://support.f5.com/csp/article/K03593314https://usn.ubuntu.com/3903-1/https://usn.ubuntu.com/3903-2/
2019-01-29
Published