CVE-2018-1059
Summary
| CVE | CVE-2018-1059 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-04-24 18:29:00 UTC |
| Updated | 2021-08-04 17:15:00 UTC |
| Description | The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable. |
Risk And Classification
Problem Types: CWE-200
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 17.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 17.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Application | Dpdk | Data Plane Development Kit | All | All | All | All |
| Application | Dpdk | Data Plane Development Kit | All | All | All | All |
| Application | Redhat | Ceph Storage | 3.0 | All | All | All |
| Application | Redhat | Ceph Storage | 3.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Application | Redhat | Enterprise Linux Fast Datapath | 7.0 | All | All | All |
| Application | Redhat | Enterprise Linux Fast Datapath | 7.0 | All | All | All |
| Application | Redhat | Openshift | 3.0 | All | All | All |
| Application | Redhat | Openshift | 3.0 | All | All | All |
| Application | Redhat | Openstack | 10 | All | All | All |
| Application | Redhat | Openstack | 10.0 | All | All | All |
| Application | Redhat | Openstack | 11 | All | All | All |
| Application | Redhat | Openstack | 11.0 | All | All | All |
| Application | Redhat | Openstack | 12 | All | All | All |
| Application | Redhat | Openstack | 12.0 | All | All | All |
| Application | Redhat | Openstack | 8 | All | All | All |
| Application | Redhat | Openstack | 8.0 | All | All | All |
| Application | Redhat | Openstack | 9 | All | All | All |
| Application | Redhat | Openstack | 9.0 | All | All | All |
| Application | Redhat | Openstack | 10.0 | All | All | All |
| Application | Redhat | Openstack | 11.0 | All | All | All |
| Application | Redhat | Openstack | 12.0 | All | All | All |
| Application | Redhat | Openstack | 8.0 | All | All | All |
| Application | Redhat | Openstack | 9.0 | All | All | All |
| Application | Redhat | Virtualization | 4.0 | All | All | All |
| Application | Redhat | Virtualization | 4.1 | All | All | All |
| Application | Redhat | Virtualization | 4.0 | All | All | All |
| Application | Redhat | Virtualization | 4.1 | All | All | All |
| Application | Redhat | Virtualization Manager | 4.1 | All | All | All |
| Application | Redhat | Virtualization Manager | 4.1 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| USN-3642-1: DPDK vulnerability | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | Third Party Advisory |
| USN-3642-2: DPDK vulnerability | Ubuntu security notices | UBUNTU | usn.ubuntu.com | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| 1544298 – (CVE-2018-1059) CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations | CONFIRM | bugzilla.redhat.com | Issue Tracking, Third Party Advisory |
| CVE-2018-1059 - Red Hat Customer Portal | MISC | access.redhat.com | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.