What’s Vulnerable › Vulnerabilities
CVE-2018-1118
- Severity: medium (CVSS 5.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-05-10 · updated 2026-06-17
- Weakness: CWE-665
Description
Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.
Affected products
- Canonical Ubuntu Linux: 16.04, 18.04
- Debian Linux: 8.0
- Linux kernel: from 4.8 before 4.18 — fixed in 4.18
- RedHat Enterprise Linux Desktop: 7.0
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Workstation: 7.0
- RedHat Virtualization Host: 4.0
How to fix
Upgrade to a fixed version: Linux kernel 4.18. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2018:2948
- https://access.redhat.com/errata/RHSA-2018:3083
- https://access.redhat.com/errata/RHSA-2018:3096
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1118
- https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html
- https://usn.ubuntu.com/3762-1/
- https://usn.ubuntu.com/3762-2/
- https://access.redhat.com/errata/RHSA-2018:2948
- https://access.redhat.com/errata/RHSA-2018:3083
- https://access.redhat.com/errata/RHSA-2018:3096
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1118
- https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html
Get alerted when CVE-2018-1118 or the next vulnerability affects your stack