Veracode Vulnerability DatabaseVERACODE:19521Information Disclosure
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
Linux kernel is vulnerable to information disclosure vulnerability. This is because Linux kernel does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. A privileged user could read some memory contents of the kernel when reading the /dev/vhost-net device file.
References
access.redhat.com/articles/3553061
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index
access.redhat.com/errata/RHSA-2018:2948
access.redhat.com/errata/RHSA-2018:3083
access.redhat.com/errata/RHSA-2018:3096
access.redhat.com/security/cve/CVE-2017-18360
access.redhat.com/security/cve/CVE-2018-1118
access.redhat.com/security/cve/CVE-2018-18690
access.redhat.com/security/updates/classification/#important
bugzilla.redhat.com/show_bug.cgi?id=1322930
bugzilla.redhat.com/show_bug.cgi?id=1488484
bugzilla.redhat.com/show_bug.cgi?id=1504058
bugzilla.redhat.com/show_bug.cgi?id=1507027
bugzilla.redhat.com/show_bug.cgi?id=1542494
bugzilla.redhat.com/show_bug.cgi?id=1557434
bugzilla.redhat.com/show_bug.cgi?id=1557599
bugzilla.redhat.com/show_bug.cgi?id=1558328
bugzilla.redhat.com/show_bug.cgi?id=1561162
bugzilla.redhat.com/show_bug.cgi?id=1563697
bugzilla.redhat.com/show_bug.cgi?id=1564186
bugzilla.redhat.com/show_bug.cgi?id=1568167
bugzilla.redhat.com/show_bug.cgi?id=1572983
bugzilla.redhat.com/show_bug.cgi?id=1573699
bugzilla.redhat.com/show_bug.cgi?id=1584775
bugzilla.redhat.com/show_bug.cgi?id=1592654
bugzilla.redhat.com/show_bug.cgi?id=1609717
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1118
lists.debian.org/debian-lts-announce/2018/07/msg00020.html
usn.ubuntu.com/3762-1/
usn.ubuntu.com/3762-2/
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N