--- title: "CVE-2018-16882\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2018-16882?format=md keywords: index, follow --- # CVE-2018-16882 Publication date 3 January 2019 Last updated 4 July 2026 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **8.8 · High** [Score breakdown](https://ubuntu.com/security/CVE-2018-16882?format=md#impact-score) Toggle side navigation ## Description A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested\_get\_vmcs12\_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi\_desc\_page' without resetting 'pi\_desc' descriptor address, which is later used in pi\_test\_and\_clear\_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before 4.14.91 and before 4.19.13 are vulnerable. ### From the Ubuntu Security Team Cfir Cohen discovered that a use-after-free vulnerability existed in the KVM implementation of the Linux kernel, when handling interrupts in environments where nested virtualization is in use (nested KVM virtualization is not enabled by default in Ubuntu kernels). A local attacker in a guest VM could possibly use this to gain administrative privileges in a host machine. [Read the notes from the security team](https://ubuntu.com/security/CVE-2018-16882?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | linux | 18.10 cosmic | Fixed 4.18.0-14.15 | | 18.04 LTS bionic | Fixed 4.15.0-44.47 | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not affected | | linux-aws | 18.10 cosmic | Fixed 4.18.0-1008.10 | | 18.04 LTS bionic | Fixed 4.15.0-1032.34 | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not affected | | linux-aws-hwe | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Fixed 4.15.0-1032.34~16.04.1 | | 14.04 LTS trusty | Not in release | | linux-azure | 18.10 cosmic | Fixed 4.18.0-1008.8 | | 18.04 LTS bionic | Fixed 4.15.0-1037.39 | | 16.04 LTS xenial | Fixed 4.15.0-1037.39~16.04.1 | | 14.04 LTS trusty | Fixed 4.15.0-1037.39~14.04.2 | | linux-azure-edge | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Fixed 4.15.0-1037.39 | | 16.04 LTS xenial | Fixed 4.15.0-1037.39~16.04.1 | | 14.04 LTS trusty | Not in release | | linux-euclid | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-flo | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-gcp | 18.10 cosmic | Fixed 4.18.0-1006.7 | | 18.04 LTS bionic | Fixed 4.15.0-1027.28 | | 16.04 LTS xenial | Fixed 4.15.0-1027.28~16.04.1 | | 14.04 LTS trusty | Not in release | | linux-gcp-edge | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Fixed 4.18.0-1006.7~18.04.1 | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-gke | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Ignored end of standard support | | 14.04 LTS trusty | Not in release | | linux-goldfish | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-grouper | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-hwe | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Fixed 4.18.0-14.15~18.04.1 | | 16.04 LTS xenial | Fixed 4.15.0-45.48~16.04.1 | | 14.04 LTS trusty | Not in release | | linux-hwe-edge | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not affected | | 16.04 LTS xenial | Fixed 4.15.0-45.48~16.04.1 | | 14.04 LTS trusty | Not in release | | linux-kvm | 18.10 cosmic | Fixed 4.18.0-1007.7 | | 18.04 LTS bionic | Fixed 4.15.0-1029.29 | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not in release | | linux-lts-trusty | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-lts-utopic | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-lts-vivid | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-lts-wily | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-lts-xenial | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not affected | | linux-maguro | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-mako | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-manta | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | linux-oem | 18.10 cosmic | Fixed 4.15.0-1033.38 | | 18.04 LTS bionic | Fixed 4.15.0-1033.38 | | 16.04 LTS xenial | Ignored end of standard support, was needs-triage | | 14.04 LTS trusty | Not in release | | linux-oracle | 18.10 cosmic | Not affected | | 18.04 LTS bionic | Fixed 4.15.0-1008.10 | | 16.04 LTS xenial | Fixed 4.15.0-1008.10~16.04.1 | | 14.04 LTS trusty | Not in release | | linux-raspi2 | 18.10 cosmic | Fixed 4.18.0-1009.11 | | 18.04 LTS bionic | Fixed 4.15.0-1031.33 | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not in release | | linux-snapdragon | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not affected | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) * [Patch details](https://ubuntu.com/security/CVE-2018-16882?format=md#patch-details) ## Notes --- ### [tyhicks](https://launchpad.net/~tyhicks) Ubuntu kernels do not enable nested KVM virtualization by default and are unaffected by this flaw in the default configuration. To ensure that nested virtualization is not enabled, verify that the /sys/module/kvm\_intel/parameters/nested file contains "N". ### Patch details For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) | Package | Patch details | | --- | --- | | linux | * Introduced by [5e2f30b](https://git.kernel.org/linus/5e2f30b756a37bd80c5b0471d0e10d769ab2eb9a), fixed by [c2dd514](https://git.kernel.org/linus/c2dd5146e9fe1f22c77c1b011adf84eea0245806) | ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 8.8 · High * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Local | | Attack complexity | Low | | Privileges required | Low | | User interaction | None | | Scope | Changed | | Confidentiality impact | High | | Integrity impact | High | | Availability impact | High | * Scores | Parameter | Value | | --- | --- | | Base score | 8.8 · High | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16882) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-16882) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2018-16882) * [Debian](https://security-tracker.debian.org/tracker/CVE-2018-16882) ### Related Ubuntu Security Notices (USN) + [USN-3878-1](https://usn.ubuntu.com/USN-3878-1) + Linux kernel vulnerabilities + 4 February 2019 + [USN-3871-4](https://usn.ubuntu.com/USN-3871-4) + Linux kernel (HWE) vulnerabilities + 4 February 2019 + [USN-3871-1](https://usn.ubuntu.com/USN-3871-1) + Linux kernel vulnerabilities + 29 January 2019 + [USN-3871-5](https://usn.ubuntu.com/USN-3871-5) + Linux kernel (Azure) vulnerabilities + 7 February 2019 + [USN-3872-1](https://usn.ubuntu.com/USN-3872-1) + Linux kernel (HWE) vulnerabilities + 29 January 2019 + [USN-3878-2](https://usn.ubuntu.com/USN-3878-2) + Linux kernel (Azure) vulnerabilities + 7 February 2019 + [USN-3871-3](https://usn.ubuntu.com/USN-3871-3) + Linux kernel (AWS, GCP, KVM, OEM, Raspberry Pi 2) vulnerabilities + 4 February 2019 ### Other references * * *