A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before 4.14.91 and before 4.19.13 are vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | debian-upgrade-linux | Jul 30, 2024 | Jan 3, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-kernel-uek | Jul 21, 2020 | Dec 18, 2018 |
| Suse | — | suse-upgrade-cluster-md-kmp-defaultsuse-upgrade-dlm-kmp-defaultsuse-upgrade-gfs2-kmp-defaultsuse-upgrade-kernel-defaultsuse-upgrade-ocfs2-kmp-default | Dec 7, 2021 | Jan 3, 2019 |
| Ubuntu | ubuntu-upgrade-linux-image-4-15-0-1027-gcpubuntu-upgrade-linux-image-4-15-0-1029-kvmubuntu-upgrade-linux-image-4-15-0-1031-raspi2ubuntu-upgrade-linux-image-4-15-0-1032-awsubuntu-upgrade-linux-image-4-15-0-1033-oemubuntu-upgrade-linux-image-4-15-0-1037-azureubuntu-upgrade-linux-image-4-15-0-44-genericubuntu-upgrade-linux-image-4-15-0-44-generic-lpaeubuntu-upgrade-linux-image-4-15-0-44-lowlatencyubuntu-upgrade-linux-image-4-15-0-44-snapdragonubuntu-upgrade-linux-image-4-15-0-45-genericubuntu-upgrade-linux-image-4-15-0-45-generic-lpaeubuntu-upgrade-linux-image-4-15-0-45-lowlatencyubuntu-upgrade-linux-image-4-18-0-1006-gcpubuntu-upgrade-linux-image-4-18-0-1007-kvmubuntu-upgrade-linux-image-4-18-0-1008-awsubuntu-upgrade-linux-image-4-18-0-1008-azureubuntu-upgrade-linux-image-4-18-0-1009-raspi2ubuntu-upgrade-linux-image-4-18-0-14-genericubuntu-upgrade-linux-image-4-18-0-14-generic-lpaeubuntu-upgrade-linux-image-4-18-0-14-lowlatencyubuntu-upgrade-linux-image-4-18-0-14-snapdragonubuntu-upgrade-linux-image-awsubuntu-upgrade-linux-image-aws-hweubuntu-upgrade-linux-image-azureubuntu-upgrade-linux-image-gcpubuntu-upgrade-linux-image-genericubuntu-upgrade-linux-image-generic-hwe-16-04ubuntu-upgrade-linux-image-generic-hwe-18-04ubuntu-upgrade-linux-image-generic-lpaeubuntu-upgrade-linux-image-generic-lpae-hwe-16-04ubuntu-upgrade-linux-image-generic-lpae-hwe-18-04ubuntu-upgrade-linux-image-gkeubuntu-upgrade-linux-image-kvmubuntu-upgrade-linux-image-lowlatencyubuntu-upgrade-linux-image-lowlatency-hwe-16-04ubuntu-upgrade-linux-image-lowlatency-hwe-18-04ubuntu-upgrade-linux-image-oemubuntu-upgrade-linux-image-raspi2ubuntu-upgrade-linux-image-snapdragonubuntu-upgrade-linux-image-snapdragon-hwe-18-04ubuntu-upgrade-linux-image-virtual-hwe-16-04 | Feb 5, 2019 | Jan 3, 2019 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jan 3, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub