CVE-2018-1059

Published Apr 24, 2018

Last updated 3 days ago

Overview

Description
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
Source
secalert@redhat.com
NVD status
Modified

Risk scores

CVSS 3.0

Type
Primary
Base score
6.1
Impact score
4
Exploitability score
1.6
Vector string
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
2.9
Impact score
2.9
Exploitability score
5.5
Vector string
AV:A/AC:M/Au:N/C:P/I:N/A:N

Weaknesses

secalert@redhat.com
CWE-200
nvd@nist.gov
CWE-200

Social media

Hype score
Not currently trending

Configurations