CVE-2018-14625 MEDIUM

CVE-2018-14625

Vendor [Unknown]
Product kernel
Weakness CWE-416
Published September 10, 2018
Last update August 5, 2024

CVSS base score

5.3/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients.

Key dates

02Disclosure timeline

September 10, 2018 CVE published
August 5, 2024 Record updated