CVE-2018-18281

Summary

CVE	CVE-2018-18281
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2018-10-30 18:29:00 UTC
Updated	2020-08-24 17:37:00 UTC
Description	Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.

Risk And Classification

Problem Types: CWE-459

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Canonical	Ubuntu Linux	12.04	All	All	All
Operating System	Canonical	Ubuntu Linux	14.04	All	All	All
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.10	All	All	All
Operating System	Canonical	Ubuntu Linux	12.04	All	All	All
Operating System	Canonical	Ubuntu Linux	14.04	All	All	All
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.10	All	All	All
Operating System	Debian	Debian Linux	8.0	All	All	All
Operating System	Debian	Debian Linux	8.0	All	All	All
Operating System	Linux	Linux Kernel	All	All	All	All
Operating System	Linux	Linux Kernel	All	All	All	All

References

Reference	Source	Link	Tags
USN-3871-3: Linux kernel (AWS, GCP, KVM, OEM, Raspberry Pi 2) vulnerabilities \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com	Third Party Advisory
1695 - Linux: mremap() TLB flush too late with concurrent ftruncate() - project-zero - Monorail	MISC	bugs.chromium.org	Exploit, Patch, Third Party Advisory
Red Hat Customer Portal	REDHAT	access.redhat.com
USN-3832-1: Linux kernel (AWS) vulnerabilities \| Ubuntu security notices	UBUNTU	usn.ubuntu.com	Third Party Advisory
cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.135	CONFIRM	cdn.kernel.org	Patch, Vendor Advisory
USN-3835-1: Linux kernel vulnerabilities \| Ubuntu security notices	UBUNTU	usn.ubuntu.com	Third Party Advisory
[SECURITY] [DLA 1715-1] linux-4.9 security update	MLIST	lists.debian.org	Mailing List, Third Party Advisory
cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.16	CONFIRM	cdn.kernel.org	Patch, Vendor Advisory
Red Hat Customer Portal	REDHAT	access.redhat.com
[SECURITY] [DLA 1731-2] linux regression update	MLIST	lists.debian.org	Mailing List, Third Party Advisory
USN-3880-1: Linux kernel vulnerabilities \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com	Third Party Advisory
kernel/git/torvalds/linux.git - Linux kernel source tree	CONFIRM	git.kernel.org	Patch, Vendor Advisory
USN-3871-5: Linux kernel (Azure) vulnerabilities \| Ubuntu security notices	UBUNTU	usn.ubuntu.com	Third Party Advisory
USN-3880-2: Linux kernel (Trusty HWE) vulnerabilities \| Ubuntu security notices	UBUNTU	usn.ubuntu.com	Third Party Advisory
USN-3871-4: Linux kernel (HWE) vulnerabilities \| Ubuntu security notices	UBUNTU	usn.ubuntu.com	Third Party Advisory
Red Hat Customer Portal	REDHAT	access.redhat.com
Linux Kernel CVE-2018-18281 Local Security Bypass Vulnerability	BID	www.securityfocus.com	Third Party Advisory, VDB Entry
Linux mremap() TLB Flush Too Late ≈ Packet Storm	MISC	packetstormsecurity.com	Patch, Third Party Advisory, VDB Entry
oss-security - Linux kernel: TLB flush happens too late on mremap (CVE-2018-18281; fixed in 4.9.135, 4.14.78, 4.18.16, 4.19)	MLIST	www.openwall.com	Mailing List, Patch, Third Party Advisory
[SECURITY] [DLA 1731-1] linux security update	MLIST	lists.debian.org	Mailing List, Third Party Advisory
Linux Kernel Components Multiple Security Vulnerabilities	BID	www.securityfocus.com	Third Party Advisory, VDB Entry
Red Hat Customer Portal	REDHAT	access.redhat.com
USN-3871-1: Linux kernel vulnerabilities \| Ubuntu security notices	UBUNTU	usn.ubuntu.com	Third Party Advisory
cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.78	CONFIRM	cdn.kernel.org	Patch, Vendor Advisory
Red Hat Customer Portal	REDHAT	access.redhat.com
Red Hat Customer Portal	REDHAT	access.redhat.com
Red Hat Customer Portal	REDHAT	access.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

376774 F5 BIG-IP Application Security Manager (ASM), Local Traffic Manager (LTM), Access Policy Manager (APM) Linux kernel Vulnerability cve-2018-18281 (K36462841)