CVE-2018-1118: canonical ubuntu_linux Improper Initialization

Vulnerability summary

CVE-2018-1118 is a medium (CVSS 5.5) Improper Initialization vulnerability in canonical ubuntu_linux. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.5% of scored vulnerabilities.

Timeline

1. 10-05-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

• CWE-665Improper InitializationThe product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.