CVE-2018-16882

Published: 3 January 2019

A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before 4.14.91 and before 4.19.13 are vulnerable.

From the Ubuntu Security Team

Cfir Cohen discovered that a use-after-free vulnerability existed in the KVM implementation of the Linux kernel, when handling interrupts in environments where nested virtualization is in use (nested KVM virtualization is not enabled by default in Ubuntu kernels). A local attacker in a guest VM could possibly use this to gain administrative privileges in a host machine.

Notes

Ubuntu kernels do not enable nested KVM virtualization by default and
are unaffected by this flaw in the default configuration. To ensure that
nested virtualization is not enabled, verify that the
/sys/module/kvm_intel/parameters/nested file contains "N".

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16882
• https://www.openwall.com/lists/oss-security/2018/12/18/6
• https://marc.info/?l=kvm&m=154514994222809&w=2
• https://ubuntu.com/security/notices/USN-3871-1
• https://ubuntu.com/security/notices/USN-3872-1
• https://ubuntu.com/security/notices/USN-3871-3
• https://ubuntu.com/security/notices/USN-3871-4
• https://ubuntu.com/security/notices/USN-3878-1
• https://ubuntu.com/security/notices/USN-3871-5
• https://ubuntu.com/security/notices/USN-3878-2
• NVD
• Launchpad
• Debian