Use-after-free error in Linux kernel - CVE-2018-16882

Vulnerability identifier: #VU16617

CSH Severity: Low

CVSS v4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-16882

CWE-ID: CWE-416

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to cause DoS condition or gain elevated privileges on the target system.

The vulnerability exists due to in nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address which is latter used in pi_test_and_clear_on(). An adjacent attacker can use a malicious container to trigger use-after-free error and crash the host kernel resulting in DoS OR potentially gain privileged access to a system.

Linux kernel
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Availability
linux (Ubuntu package)
linux-hwe (Ubuntu package)
kgraft-patch-4_4_180-94_150-default-debuginfo
kgraft-patch-4_4_180-94_150-default
kernel-devel
kernel-macros
kernel-source
kernel-default
kernel-default-base
kernel-default-base-debuginfo
kernel-default-debuginfo
kernel-default-debugsource
kernel-default-devel
kernel-syms
cluster-md-kmp-default-debuginfo
cluster-md-kmp-default
kernel-default-man
dlm-kmp-default
dlm-kmp-default-debuginfo
gfs2-kmp-default
gfs2-kmp-default-debuginfo
ocfs2-kmp-default
ocfs2-kmp-default-debuginfo
kernel-default-kgraft

Install update from vendor's website.

linux (Ubuntu package) - update to 4.18.0-15.16
linux-hwe (Ubuntu package) - update to 4.18.0-15.16~18.04.1
kgraft-patch-4_4_180-94_150-default-debuginfo - update to 1-4.3.1
kgraft-patch-4_4_180-94_150-default - update to 1-4.3.1
kernel-devel - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-macros - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-source - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default-base - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default-base-debuginfo - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default-debuginfo - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default-debugsource - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default-devel - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-syms - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
cluster-md-kmp-default-debuginfo - update to 4.4.180-94.150.1
cluster-md-kmp-default - update to 4.4.180-94.150.1
kernel-default-man - update to 4.4.180-94.150.1
dlm-kmp-default - update to 4.4.180-94.150.1
dlm-kmp-default-debuginfo - update to 4.4.180-94.150.1
gfs2-kmp-default - update to 4.4.180-94.150.1
gfs2-kmp-default-debuginfo - update to 4.4.180-94.150.1
ocfs2-kmp-default - update to 4.4.180-94.150.1
ocfs2-kmp-default-debuginfo - update to 4.4.180-94.150.1
kernel-default-kgraft - update to 4.4.180-94.150.1

• https://bugzilla.redhat.com/show_bug.cgi?id=1660604

• Multiple vulnerabilities in Linux Kernel
• Ubuntu update for Linux kernel
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel