CVE-2018-20855 An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to....
LowCVSS 3.3
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.18.8-1 | 4.18.8-1 |
| debian/linux(Debian:13) | < 4.18.8-1 | 4.18.8-1 |
| debian/linux(Debian:14) | < 4.18.8-1 | 4.18.8-1 |
| Linux kernel | < 4.18.7 | 4.18.7 |
| openSUSE leap | = 15.0 | No fix listed |
| openSUSE leap | = 15.1 | No fix listed |
| netapp active iq performance analytics services | All versions | No fix listed |
| netapp active iq unified manager | >= 9.5 | No fix listed |
| netapp data availability services | All versions | No fix listed |
| netapp element software | All versions | No fix listed |
References
- Debian Security Tracker CVE-2018-20855 vendor-advisory
- openSUSE-SU-2019:1924 third-party-advisory vendor-advisory
- openSUSE-SU-2019:1923 third-party-advisory vendor-advisory
- cdn.kernel.org mailing-list release-notes vendor-advisory
- git.kernel.org mailing-list patch vendor-advisory
- github.com patch third-party-advisory
- security.netapp.com third-party-advisory