Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
No history.
Information
Published : 2018-10-30 18:29
Updated : 2024-02-28 16:48
NVD link : CVE-2018-18281
Mitre link : CVE-2018-18281
CVE.ORG link : CVE-2018-18281
JSON object : View
Products Affected
linux
- linux_kernel
canonical
- ubuntu_linux
debian
- debian_linux
CWE
CWE-459
Incomplete Cleanup