CVE-2018-16882Use After Free in Kernel

CWE-416Use After Free23 documents7 sources
Severity
8.8HIGHNVD
OSV7.0OSV5.5
EPSS
0.1%
top 72.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 3
Latest updateMay 13

Description

A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 2.0 | Impact: 6.0

Affected Packages5 packages

CVEListV5the_linux_foundation/kernelbefore 4.14.91, before 4.19.13+1
NVDlinux/linux_kernel4.144.14.91+1
Debianlinux/linux_kernel< 4.19.13-1+3
Ubuntulinux/linux_kernel< 4.15.0-44.47+1
debiandebian/linux< linux 4.19.13-1 (bookworm)

Also affects: Ubuntu Linux 14.04, 16.04, 18.04, 18.10

Patches

🔴Vulnerability Details

9
GHSA
GHSA-4wh7-45g5-wcc8: A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled2022-05-13
OSV
linux, linux-hwe regression2019-02-08
OSV
linux-azure vulnerabilities2019-02-07
OSV
linux-aws, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities2019-02-04
OSV
linux-hwe, linux-aws-hwe, linux-gcp vulnerabilities2019-02-04

📋Vendor Advisories

11
Ubuntu
Linux kernel regression2019-02-08
Ubuntu
Linux kernel (Azure) vulnerabilities2019-02-07
Ubuntu
Linux kernel (Azure) vulnerabilities2019-02-07
Ubuntu
Linux kernel (AWS, GCP, KVM, OEM, Raspberry Pi 2) vulnerabilities2019-02-04
Ubuntu
Linux kernel vulnerabilities2019-02-04

💬Community

2
Bugzilla
CVE-2018-16882 Kernel: KVM: nVMX: use after free in posted interrupt processing2018-12-18
Bugzilla
CVE-2018-16882 kernel: KVM: nVMX: use after free in posted interrupt processing [fedora-all]2018-12-18