redhat virtualization-host CVE-2018-1118 vulnerability in Red Hat and Other Products
Published on May 10, 2018

product logo product logo product logo product logo
Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Weakness Type

Improper Initialization

The software does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.


Products Associated with CVE-2018-1118

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2018-1118 are published in these products:

Red Hat Virtualization Host
 
Canonical Ubuntu Linux
 
Debian Linux
 
Linux Kernel
 
Red Hat Enterprise Linux Desktop
 
Red Hat Enterprise Linux Server
 
Red Hat Enterprise Linux Workstation
 

Affected Versions

kernel vhost Version since 4.8 is affected by CVE-2018-1118

Exploit Probability

EPSS
0.11%
Percentile
29.05%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.