CVE-2018-1059

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when…

Medium6.1EPSS 0.79%

Published: 24 Apr 2018
Updated: 17 Sept 2024
Reserved: 4 Dec 2017
Assigned by: redhat

Description

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

Scores

CVSS scores of CVE-2018-1059, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	3.0	Medium6.1	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS (exploitation in 30 days): 0.79% · top 44% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

CWE-200 (opens in a new tab)All about CWE-200 and its CVEs

Affected products

Red Hat, Inc. · DPDK
- affected before 18.02.1

References (8)

RHSA-2018:2524 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
RHSA-2018:2102 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
https://access.redhat.com/security/cve/cve-2018-1059 (opens in a new tab)x_refsource_MISCx_transferred
USN-3642-2 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
RHSA-2018:2038 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
USN-3642-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
RHSA-2018:1267 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=1544298 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2018-1059](https://trackcve.app/badge/CVE-2018-1059.svg)](https://trackcve.app/cve/CVE-2018-1059)

Record last updated 17 Sept 2024, 00:46 UTC.