CVE-2018-18281
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.6 Medium
AI Score
Confidence
High
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
43.8%
Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.
References
packetstormsecurity.com/files/150001/Linux-mremap-TLB-Flush-Too-Late.html
www.openwall.com/lists/oss-security/2018/10/29/5
www.securityfocus.com/bid/105761
www.securityfocus.com/bid/106503
access.redhat.com/errata/RHSA-2019:0831
access.redhat.com/errata/RHSA-2019:2029
access.redhat.com/errata/RHSA-2019:2043
access.redhat.com/errata/RHSA-2020:0036
access.redhat.com/errata/RHSA-2020:0100
access.redhat.com/errata/RHSA-2020:0103
access.redhat.com/errata/RHSA-2020:0179
bugs.chromium.org/p/project-zero/issues/detail?id=1695
cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.78
cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.16
cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.135
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eb66ae030829605d61fbef1909ce310e29f78821
lists.debian.org/debian-lts-announce/2019/03/msg00017.html
lists.debian.org/debian-lts-announce/2019/03/msg00034.html
lists.debian.org/debian-lts-announce/2019/04/msg00004.html
usn.ubuntu.com/3832-1/
usn.ubuntu.com/3835-1/
usn.ubuntu.com/3871-1/
usn.ubuntu.com/3871-3/
usn.ubuntu.com/3871-4/
usn.ubuntu.com/3871-5/
usn.ubuntu.com/3880-1/
usn.ubuntu.com/3880-2/
Social References
More
Related
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.6 Medium
AI Score
Confidence
High
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
43.8%