CVE-2018-1118CWE-665

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the…

Low · published May 10, 2018

CVSS v3.0
2.3
EPSS
0%
Percentile
30.2
In the wild
Unconfirmed
What it is

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

The record
Technical detail
CVSS v3.0
2.3 · LOW
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00374 · 30.2th percentile
Weakness
CWE-665 · Improper Initialization
Published
2018-05-10T22:00Z
EPSS history
Timeline
  • 10 MAY 22:00Z
    Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the…
    cvelistv5