Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate()…

Description

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.

Scores

EPSS (exploitation in 30 days)

1.1% · top 34% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

• n/a
• CWE-459 (opens in a new tab)All about CWE-459 and its CVEs

Affected products

• n/a

  • affected n/a

References (27)

• http://packetstormsecurity.com/files/150001/Linux-mremap-TLB-Flush-Too-Late.html (opens in a new tab)x_refsource_MISCx_transferred
• USN-3835-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.16 (opens in a new tab)x_refsource_CONFIRMx_transferred
• USN-3880-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• USN-3871-5 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• USN-3871-4 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• [oss-security] 20181029 Linux kernel: TLB flush happens too late on mremap (CVE-2018-18281; fixed in 4.9.135, 4.14.78, 4.18.16, 4.19) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• USN-3880-2 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• USN-3832-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eb66ae030829605d61fbef1909ce310e29f78821 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 105761 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• USN-3871-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.78 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 106503 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• USN-3871-3 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1695 (opens in a new tab)x_refsource_MISCx_transferred
• [debian-lts-announce] 20190315 [SECURITY] [DLA 1715-1] linux-4.9 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.135 (opens in a new tab)x_refsource_CONFIRMx_transferred
• [debian-lts-announce] 20190327 [SECURITY] [DLA 1731-1] linux security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [debian-lts-announce] 20190401 [SECURITY] [DLA 1731-2] linux regression update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2019:0831 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2019:2043 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2019:2029 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0036 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0100 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0103 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0179 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2018-18281](https://trackcve.app/badge/CVE-2018-18281.svg)](https://trackcve.app/cve/CVE-2018-18281)

Record last updated 5 Aug 2024, 11:08 UTC.