VULNERABILITY INTELLIGENCE

CVE-2018-1059

CVSS score6.1 MEDIUM
EPSS probability0.79%
CISA KEVNot currently listed
Published2018-04-24
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Description

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references