Early Access — Mondoo Vulnerability Intelligence is currently in preview.

UBUNTU-CVE-2018-16882 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2018-16882

HIGH8.8

A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error w

Published Jan 3, 2019

Modified 7 months ago

Fix available

Details

A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before 4.14.91 and before 4.19.13 are vulnerable.

Affected Packages

Ubuntu:18.04:LTSlinux

Affected versions:

4.13.0-16.194.13.0-17.204.13.0-25.294.13.0-32.354.15.0-10.114.15.0-12.134.15.0-13.144.15.0-15.164.15.0-19.204.15.0-20.21+13 more

Fixed in:

4.15.0-44.47

Ubuntu:14.04:LTSlinux

Fixed in:

3.11.0-12.19

Ubuntu:16.04:LTSlinux

Fixed in:

4.2.0-16.19

Ubuntu:14.04:LTSlinux-aws

Fixed in:

4.4.0-1002.2

Ubuntu:16.04:LTSlinux-aws

Fixed in:

4.4.0-1001.10

Ubuntu:18.04:LTSlinux-aws

Affected versions:

4.15.0-1001.14.15.0-1003.34.15.0-1005.54.15.0-1006.64.15.0-1007.74.15.0-1009.94.15.0-1010.104.15.0-1011.114.15.0-1016.164.15.0-1017.17+8 more

Fixed in:

4.15.0-1032.34

Ubuntu:16.04:LTSlinux-aws-hwe

Affected versions:

4.15.0-1030.31~16.04.14.15.0-1031.33~16.04.1

Fixed in:

4.15.0-1032.34~16.04.1

Ubuntu:14.04:LTSlinux-azure

Affected versions:

4.15.0-1023.24~14.04.14.15.0-1030.31~14.04.14.15.0-1031.32~14.04.14.15.0-1032.33~14.04.24.15.0-1035.36~14.04.24.15.0-1036.38~14.04.2

Fixed in:

4.15.0-1037.39~14.04.2

Ubuntu:16.04:LTSlinux-azure

Affected versions:

4.11.0-1009.94.11.0-1011.114.11.0-1013.134.11.0-1014.144.11.0-1015.154.11.0-1016.164.13.0-1005.74.13.0-1006.84.13.0-1007.94.13.0-1009.12+19 more

Fixed in:

4.15.0-1037.39~16.04.1

Ubuntu:18.04:LTSlinux-azure

Affected versions:

4.15.0-1002.24.15.0-1003.34.15.0-1004.44.15.0-1008.84.15.0-1009.94.15.0-1012.124.15.0-1013.134.15.0-1014.144.15.0-1018.184.15.0-1019.19+10 more

Fixed in:

4.15.0-1037.39

Ubuntu:16.04:LTSlinux-euclid

Fixed in:

4.4.0-9019.20

Ubuntu:18.04:LTSlinux-gcp

Affected versions:

4.15.0-1001.14.15.0-1003.34.15.0-1005.54.15.0-1006.64.15.0-1008.84.15.0-1009.94.15.0-1010.104.15.0-1014.144.15.0-1015.154.15.0-1017.18+7 more

Fixed in:

4.15.0-1027.28

Ubuntu:16.04:LTSlinux-gcp

Affected versions:

4.10.0-1004.44.10.0-1006.64.10.0-1007.74.10.0-1008.84.10.0-1009.94.13.0-1002.54.13.0-1006.94.13.0-1007.104.13.0-1008.114.13.0-1011.15+15 more

Fixed in:

4.15.0-1027.28~16.04.1

Ubuntu:18.04:LTSlinux-gcp-edge

Affected versions:

4.18.0-1004.5~18.04.14.18.0-1005.6~18.04.1

Fixed in:

4.18.0-1006.7~18.04.1

Ubuntu:16.04:LTSlinux-hwe

Affected versions:

4.10.0-27.30~16.04.24.10.0-28.32~16.04.24.10.0-30.34~16.04.14.10.0-32.36~16.04.14.10.0-33.37~16.04.14.10.0-35.39~16.04.14.10.0-37.41~16.04.14.10.0-38.42~16.04.14.10.0-40.44~16.04.14.10.0-42.46~16.04.1+35 more

Fixed in:

4.15.0-45.48~16.04.1

Ubuntu:18.04:LTSlinux-hwe

Affected versions:

4.18.0-13.14~18.04.1

Fixed in:

4.18.0-14.15~18.04.1

Ubuntu:18.04:LTSlinux-kvm

Affected versions:

4.15.0-1002.24.15.0-1003.34.15.0-1004.44.15.0-1006.64.15.0-1008.84.15.0-1010.104.15.0-1011.114.15.0-1012.124.15.0-1016.164.15.0-1017.17+8 more

Fixed in:

4.15.0-1029.29

Ubuntu:16.04:LTSlinux-kvm

Fixed in:

4.4.0-1004.9

Ubuntu:14.04:LTSlinux-lts-xenial

Fixed in:

4.4.0-13.29~14.04.1

Ubuntu:18.04:LTSlinux-oem

Affected versions:

4.15.0-1002.34.15.0-1004.54.15.0-1006.94.15.0-1008.114.15.0-1009.124.15.0-1012.154.15.0-1013.164.15.0-1015.184.15.0-1017.204.15.0-1018.21+5 more

Fixed in:

4.15.0-1033.38

Ubuntu:16.04:LTSlinux-oracle

Affected versions:

4.15.0-1007.9~16.04.1

Fixed in:

4.15.0-1008.10~16.04.1

Ubuntu:18.04:LTSlinux-oracle

Affected versions:

4.15.0-1007.9

Fixed in:

4.15.0-1008.10

Ubuntu:16.04:LTSlinux-raspi2

Fixed in:

4.2.0-1013.19

Ubuntu:18.04:LTSlinux-raspi2

Affected versions:

4.13.0-1005.54.13.0-1006.64.13.0-1008.84.15.0-1006.74.15.0-1009.104.15.0-1010.114.15.0-1011.124.15.0-1012.134.15.0-1013.144.15.0-1017.18+10 more

Fixed in:

4.15.0-1031.33

Ubuntu:16.04:LTSlinux-snapdragon

Fixed in:

4.4.0-1012.12

References

REPORThttps://marc.info/?l=kvm&m=154514994222809&w=2 REPORThttps://ubuntu.com/security/CVE-2018-16882 REPORThttps://ubuntu.com/security/notices/USN-3871-1 REPORThttps://ubuntu.com/security/notices/USN-3871-3 REPORThttps://ubuntu.com/security/notices/USN-3871-4 REPORThttps://ubuntu.com/security/notices/USN-3871-5 REPORThttps://ubuntu.com/security/notices/USN-3872-1 REPORThttps://ubuntu.com/security/notices/USN-3878-1 REPORThttps://ubuntu.com/security/notices/USN-3878-2 REPORThttps://www.cve.org/CVERecord?id=CVE-2018-16882 REPORThttps://www.openwall.com/lists/oss-security/2018/12/18/6

CVSS Analysis

CVSS v3.0

8.8

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

HighAC:H

Privileges Required

HighPR:H

User Interaction

NoneUI:N

Scope

Scope

ChangedS:C

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

HighA:H

CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:H

Related

CVE-2018-16882 USN-3871-1 USN-3871-3 USN-3871-4 USN-3871-5 USN-3872-1 USN-3878-1 USN-3878-2

Ecosystems

Ubuntu 18.04 LTS Ubuntu 14.04 LTS Ubuntu 16.04 LTS

Timeline

PublishedJan 3, 2019

ModifiedJun 2, 2025