SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2018-1118

This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

MEDIUM 5.5EPSS 0.39%

Does this matter?

Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.

Description

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

CVSS 3.0
5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.39% probability · 32th percentile
CISA KEV
Not listed
Weakness
CWE-665, CWE-200
Affected
linux/linux kernel · debian/debian linux · canonical/ubuntu linux · redhat/virtualization host · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux workstation
Source
secalert@redhat.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.