p PatchFirst

CVE-2018-1059

CVE-2018-1059

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

CVSS 6.1 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dpdk

    Versions
    • before 18.02.1: Affected

    No fix published

  • dpdk Debian:12

    Affected ranges
    • ECOSYSTEM: < 17.11.2-1

    Update to 17.11.2-1

  • dpdk Debian:13

    Affected ranges
    • ECOSYSTEM: < 17.11.2-1

    Update to 17.11.2-1

  • dpdk Debian:14

    Affected ranges
    • ECOSYSTEM: < 17.11.2-1

    Update to 17.11.2-1

  • dpdk Ubuntu:16.04:LTS

    Versions
    • 2.0.0-0ubuntu1
    • 2.0.0-0ubuntu2
    • 2.0.0-0ubuntu3
    • 2.2.0-0ubuntu1
    • 2.2.0-0ubuntu3
    • 2.2.0-0ubuntu5
    • 2.2.0-0ubuntu6
    • 2.2.0-0ubuntu7
    • 2.2.0-0ubuntu8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dpdk Ubuntu:18.04:LTS

    Versions
    • 17.05.2-0ubuntu1
    • 17.05.2-0ubuntu2
    • 17.11-3
    • 17.11-4
    • 17.11-5
    • 17.11.1-6
    Affected ranges
    • ECOSYSTEM: < 17.11.2-1ubuntu0.1

    Update to 17.11.2-1ubuntu0.1

Original sources

Check your server →