{"schemaVersion":3,"id":"USN-3903-2","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"linux-hwe, linux-azure vulnerabilities\n\nUSN-3903-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10.\nThis update provides the corresponding updates for the Linux Hardware\nEnablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS.\n\nJason Wang discovered that the vhost net driver in the Linux kernel\ncontained an out of bounds write vulnerability. An attacker in a guest\nvirtual machine could use this to cause a denial of service (host system\ncrash) or possibly execute arbitrary code in the host kernel.\n(CVE-2018-16880)\n\nJann Horn discovered that the userfaultd implementation in the Linux kernel\ndid not properly restrict access to certain ioctls. A local attacker could\nuse this possibly to modify files. (CVE-2018-18397)\n\nJann Horn discovered a race condition in the fork() system call in the\nLinux kernel. A local attacker could use this to gain access to services\nthat cache authorizations. (CVE-2019-6133)","dates":{"published":"2019-03-06T19:33:05.000Z","modified":"2026-02-10T04:41:29.000Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"linux-azure","name":"linux-azure","label":"linux-azure","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/linux-azure","purlType":"deb","versions":[{"text":"< 4.18.0-1013.13~18.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.18.0-1013.13~18.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"linux-hwe","name":"linux-hwe","label":"linux-hwe","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/linux-hwe","purlType":"deb","versions":[{"text":"< 4.18.0-16.17~18.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.18.0-16.17~18.04.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-3903-2","label":"ubuntu.com/security/notices/USN-3903-2","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-16880","label":"ubuntu.com/security/CVE-2018-16880","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-18397","label":"ubuntu.com/security/CVE-2018-18397","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2019-6133","label":"ubuntu.com/security/CVE-2019-6133","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2018-16880","CVE-2018-18397","CVE-2019-6133"],"downstream":[],"duplicates":[],"related":["CVE-2018-16880","CVE-2018-18397","CVE-2019-6133"]},"timeline":[{"kind":"published","date":"2019-03-06T19:33:05.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-10T04:41:29.000Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T20:41:10.458Z","stale":false,"partial":false}}