CVE-2018-18281
Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.06%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.
- CVSS 3.0
- 7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.06% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-459
- Affected
- linux/linux kernel · canonical/ubuntu linux · debian/debian linux
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/150001/Linux-mremap-TLB-Flush-Too-Late.htmlPatch, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2018/10/29/5Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/105761Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/106503Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:0831
- https://access.redhat.com/errata/RHSA-2019:2029
- https://access.redhat.com/errata/RHSA-2019:2043
- https://access.redhat.com/errata/RHSA-2020:0036
- https://access.redhat.com/errata/RHSA-2020:0100
- https://access.redhat.com/errata/RHSA-2020:0103
- https://access.redhat.com/errata/RHSA-2020:0179
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1695Exploit, Patch, Third Party Advisory
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.78Patch, Vendor Advisory
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.16Patch, Vendor Advisory
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.135Patch, Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eb66ae030829605d61fbef1909ce310e29f78821Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00034.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/04/msg00004.htmlMailing List, Third Party Advisory
- https://usn.ubuntu.com/3832-1/Third Party Advisory
- https://usn.ubuntu.com/3835-1/Third Party Advisory
- https://usn.ubuntu.com/3871-1/Third Party Advisory
- https://usn.ubuntu.com/3871-3/Third Party Advisory
- https://usn.ubuntu.com/3871-4/Third Party Advisory
- https://usn.ubuntu.com/3871-5/Third Party Advisory
- https://usn.ubuntu.com/3880-1/Third Party Advisory
- https://usn.ubuntu.com/3880-2/Third Party Advisory
- http://packetstormsecurity.com/files/150001/Linux-mremap-TLB-Flush-Too-Late.htmlPatch, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2018/10/29/5Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/105761Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.