CVE-2018-1059 The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translati...
MediumCVSS 6.1
EPSS 0.79%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/dpdk(Debian:12) | < 17.11.2-1 | 17.11.2-1 |
| debian/dpdk(Debian:13) | < 17.11.2-1 | 17.11.2-1 |
| debian/dpdk(Debian:14) | < 17.11.2-1 | 17.11.2-1 |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| redhat ceph storage | = 3.0 | No fix listed |
| redhat enterprise linux fast datapath | = 7.0 | No fix listed |
| redhat openshift | = 3.0 | No fix listed |
| redhat openstack | = 8 | No fix listed |
| redhat openstack | = 9 | No fix listed |
| redhat openstack | = 10 | No fix listed |
| redhat openstack | = 11 | No fix listed |
| redhat openstack | = 12 | No fix listed |
| redhat virtualization | = 4.0 | No fix listed |
| redhat virtualization | = 4.1 | No fix listed |
| redhat virtualization manager | = 4.1 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| dpdk data plane development kit | < 18.02.1 | 18.02.1 |
| redhat/dpdk | = before 18.02.1 | No fix listed |
References
- Debian Security Tracker CVE-2018-1059 vendor-advisory
- RHSA-2018:1267 third-party-advisory vendor-advisory
- RHSA-2018:2038 vendor-advisory
- RHSA-2018:2102 vendor-advisory
- RHSA-2018:2524 vendor-advisory
- access.redhat.com third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- USN-3642-1 third-party-advisory vendor-advisory
- USN-3642-2 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking