CVE-2018-18281

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks

published October 30, 2018

CVSS
—
EPSS
1%
Percentile
65.5
In the wild
Unconfirmed
What it is

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01104 · 65.5th percentile
Published
2018-10-30T18:00Z
EPSS history
Timeline
  • 30 OCT 18:00Z
    Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks
    cvelistv5