CVE-2018-20168

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-17 · updated 2026-06-17
Weakness: CWE-20

Description

Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service ("physical address not valid" panic) via a crafted application.

Affected products

Google gVisor: before 2018-08-22 — fixed in 2018-08-22

How to fix

Upgrade to a fixed version: Google gVisor 2018-08-22. Check the vendor advisory for mitigations.

References

https://bugs.chromium.org/p/project-zero/issues/detail?id=1674
https://bugs.chromium.org/p/project-zero/issues/detail?id=1674

Get alerted when CVE-2018-20168 or the next vulnerability affects your stack