Early Access — Mondoo Vulnerability Intelligence is currently in preview.

UBUNTU-CVE-2018-1118 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2018-1118

MEDIUM5.5

Published May 10, 2018

Modified 7 months ago

Fix available

Details

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

Affected Packages

Ubuntu:18.04:LTSlinux

Affected versions:

4.13.0-16.194.13.0-17.204.13.0-25.294.13.0-32.354.15.0-10.114.15.0-12.134.15.0-13.144.15.0-15.164.15.0-19.204.15.0-20.21+7 more

Fixed in:

4.15.0-34.37

Ubuntu:18.04:LTSlinux-aws

Affected versions:

4.15.0-1001.14.15.0-1003.34.15.0-1005.54.15.0-1006.64.15.0-1007.74.15.0-1009.94.15.0-1010.104.15.0-1011.114.15.0-1016.164.15.0-1017.17+2 more

Fixed in:

4.15.0-1021.21

Ubuntu:14.04:LTSlinux-azure

Fixed in:

4.15.0-1023.24~14.04.1

Ubuntu:16.04:LTSlinux-azure

Affected versions:

4.11.0-1009.94.11.0-1011.114.11.0-1013.134.11.0-1014.144.11.0-1015.154.11.0-1016.164.13.0-1005.74.13.0-1006.84.13.0-1007.94.13.0-1009.12+11 more

Fixed in:

4.15.0-1023.24~16.04.1

Ubuntu:18.04:LTSlinux-azure

Affected versions:

4.15.0-1002.24.15.0-1003.34.15.0-1004.44.15.0-1008.84.15.0-1009.94.15.0-1012.124.15.0-1013.134.15.0-1014.144.15.0-1018.184.15.0-1019.19+2 more

Fixed in:

4.15.0-1023.24

Ubuntu:16.04:LTSlinux-gcp

Affected versions:

4.10.0-1004.44.10.0-1006.64.10.0-1007.74.10.0-1008.84.10.0-1009.94.13.0-1002.54.13.0-1006.94.13.0-1007.104.13.0-1008.114.13.0-1011.15+9 more

Fixed in:

4.15.0-1019.20~16.04.1

Ubuntu:18.04:LTSlinux-gcp

Affected versions:

4.15.0-1001.14.15.0-1003.34.15.0-1005.54.15.0-1006.64.15.0-1008.84.15.0-1009.94.15.0-1010.104.15.0-1014.144.15.0-1015.154.15.0-1017.18+1 more

Fixed in:

4.15.0-1019.20

Ubuntu:16.04:LTSlinux-hwe

Affected versions:

4.10.0-27.30~16.04.24.10.0-28.32~16.04.24.10.0-30.34~16.04.14.10.0-32.36~16.04.14.10.0-33.37~16.04.14.10.0-35.39~16.04.14.10.0-37.41~16.04.14.10.0-38.42~16.04.14.10.0-40.44~16.04.14.10.0-42.46~16.04.1+29 more

Fixed in:

4.15.0-34.37~16.04.1

Ubuntu:18.04:LTSlinux-kvm

Affected versions:

4.15.0-1002.24.15.0-1003.34.15.0-1004.44.15.0-1006.64.15.0-1008.84.15.0-1010.104.15.0-1011.114.15.0-1012.124.15.0-1016.164.15.0-1017.17+2 more

Fixed in:

4.15.0-1021.21

Ubuntu:18.04:LTSlinux-oem

Affected versions:

4.15.0-1002.34.15.0-1004.54.15.0-1006.94.15.0-1008.114.15.0-1009.124.15.0-1012.154.15.0-1013.164.15.0-1015.184.15.0-1017.20

Fixed in:

4.15.0-1018.21

Ubuntu:18.04:LTSlinux-raspi2

Affected versions:

4.13.0-1005.54.13.0-1006.64.13.0-1008.84.15.0-1006.74.15.0-1009.104.15.0-1010.114.15.0-1011.124.15.0-1012.134.15.0-1013.144.15.0-1017.18+3 more

Fixed in:

4.15.0-1022.24

References

REPORThttps://lkml.org/lkml/2018/4/27/833 REPORThttps://lkml.org/lkml/2018/5/29/1324 REPORThttps://ubuntu.com/security/CVE-2018-1118 REPORThttps://ubuntu.com/security/notices/USN-3762-1 REPORThttps://ubuntu.com/security/notices/USN-3762-2 REPORThttps://www.cve.org/CVERecord?id=CVE-2018-1118

CVSS Analysis

CVSS v3.0

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

HighPR:H

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

NoneA:N

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CVE-2018-1118 USN-3762-1 USN-3762-2

Ecosystems

Ubuntu 18.04 LTS Ubuntu 14.04 LTS Ubuntu 16.04 LTS

Timeline

PublishedMay 10, 2018

ModifiedJun 2, 2025

UBUNTU-CVE-2018-1118

Details

Affected Packages

References

CVSS Analysis

Related

Ecosystems

Timeline