CVE-2018-15471 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2018-15471 Interim 1 34 2023-09-12T00:28:41Z current 2021-05-30T14:15:54Z 2023-09-12T00:28:41Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2018-15471 An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2018-September/004544.html E-Mail link for SUSE-SU-2018:2677-1 https://lists.suse.com/pipermail/sle-security-updates/2018-September/004545.html E-Mail link for SUSE-SU-2018:2678-1 https://lists.suse.com/pipermail/sle-security-updates/2018-September/004621.html E-Mail link for SUSE-SU-2018:2933-1 https://lists.suse.com/pipermail/sle-security-updates/2018-September/004623.html E-Mail link for SUSE-SU-2018:2935-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Live Patching 15 SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Real Time 12 SP5 SUSE Real Time Module 15 SP1 SUSE Real Time Module 15 SP2 SUSE Linux Enterprise Server 12 SP4-ESPOS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Server Business Critical Linux 15 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Manager Proxy 4.0 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Manager Retail Branch Server 4.0 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Manager Server 4.0 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 kernel-devel-azure kernel-devel-rt kernel-livepatch-4_12_14-23-default-3-7.3 kernel-livepatch-4_12_14-25_13-default-3-2.3 kernel-livepatch-4_12_14-25_3-default-3-2.1 kernel-livepatch-4_12_14-25_6-default-3-2.1 kernel-rt kernel-source-azure kernel-source-rt kernel-livepatch-4_12_14-23-default-3-7.3 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-25_13-default-3-2.3 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-25_3-default-3-2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-25_6-default-3-2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-source-azure as a component of SUSE CaaS Platform 4.0 kernel-source-azure as a component of SUSE Enterprise Storage 6 kernel-source-azure as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 kernel-source-azure as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS kernel-rt as a component of SUSE Linux Enterprise Micro 5.0 kernel-source-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 kernel-source-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP1 kernel-devel-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP2 kernel-source-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP2 kernel-devel-rt as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-source-rt as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-source-azure as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS kernel-source-azure as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-devel-azure as a component of SUSE Linux Enterprise Server 12 SP5 kernel-source-azure as a component of SUSE Linux Enterprise Server 12 SP5 kernel-source-azure as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-source-azure as a component of SUSE Linux Enterprise Server Business Critical Linux 15 SP1 kernel-source-azure as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 kernel-source-azure as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 kernel-source-azure as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 kernel-source-azure as a component of SUSE Manager Proxy 4.0 kernel-source-azure as a component of SUSE Manager Retail Branch Server 4.0 kernel-source-azure as a component of SUSE Manager Server 4.0 kernel-source-azure as a component of SUSE OpenStack Cloud 9 kernel-source-azure as a component of SUSE OpenStack Cloud Crowbar 9 kernel-devel-rt as a component of SUSE Real Time Module 15 SP1 kernel-source-rt as a component of SUSE Real Time Module 15 SP1 kernel-devel-rt as a component of SUSE Real Time Module 15 SP2 kernel-source-rt as a component of SUSE Real Time Module 15 SP2 An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks. CVE-2018-15471 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-23-default-3-7.3 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_13-default-3-2.3 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_3-default-3-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_6-default-3-2.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP1:kernel-livepatch-4_12_14-23-default-3-7.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP1:kernel-livepatch-4_12_14-25_13-default-3-2.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP1:kernel-livepatch-4_12_14-25_3-default-3-2.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP1:kernel-livepatch-4_12_14-25_6-default-3-2.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP2:kernel-livepatch-4_12_14-23-default-3-7.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP2:kernel-livepatch-4_12_14-25_13-default-3-2.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP2:kernel-livepatch-4_12_14-25_3-default-3-2.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP2:kernel-livepatch-4_12_14-25_6-default-3-2.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP3:kernel-livepatch-4_12_14-23-default-3-7.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP3:kernel-livepatch-4_12_14-25_13-default-3-2.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP3:kernel-livepatch-4_12_14-25_3-default-3-2.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP3:kernel-livepatch-4_12_14-25_6-default-3-2.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:kernel-livepatch-4_12_14-23-default-3-7.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:kernel-livepatch-4_12_14-25_13-default-3-2.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:kernel-livepatch-4_12_14-25_3-default-3-2.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:kernel-livepatch-4_12_14-25_6-default-3-2.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:kernel-livepatch-4_12_14-23-default-3-7.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:kernel-livepatch-4_12_14-25_13-default-3-2.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:kernel-livepatch-4_12_14-25_3-default-3-2.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:kernel-livepatch-4_12_14-25_6-default-3-2.1 SUSE CaaS Platform 4.0:kernel-source-azure SUSE Enterprise Storage 6:kernel-source-azure SUSE Linux Enterprise High Performance Computing 12 SP5:kernel-source-azure SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:kernel-source-azure SUSE Linux Enterprise Micro 5.0:kernel-rt SUSE Linux Enterprise Module for Public Cloud 15 SP1:kernel-source-azure SUSE Linux Enterprise Module for Public Cloud 15 SP2:kernel-devel-azure SUSE Linux Enterprise Module for Public Cloud 15 SP2:kernel-source-azure SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt SUSE Linux Enterprise Server 12 SP4-ESPOS:kernel-source-azure SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-source-azure SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure SUSE Linux Enterprise Server 12 SP5:kernel-source-azure SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-source-azure SUSE Linux Enterprise Server Business Critical Linux 15 SP1:kernel-source-azure SUSE Linux Enterprise Server for SAP Applications 12 SP4:kernel-source-azure SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure SUSE Linux Enterprise Server for SAP Applications 15 SP1:kernel-source-azure SUSE Manager Proxy 4.0:kernel-source-azure SUSE Manager Retail Branch Server 4.0:kernel-source-azure SUSE Manager Server 4.0:kernel-source-azure SUSE OpenStack Cloud 9:kernel-source-azure SUSE OpenStack Cloud Crowbar 9:kernel-source-azure SUSE Real Time Module 15 SP1:kernel-devel-rt SUSE Real Time Module 15 SP1:kernel-source-rt SUSE Real Time Module 15 SP2:kernel-devel-rt SUSE Real Time Module 15 SP2:kernel-source-rt SUSE Linux Enterprise Module for Public Cloud 15:kernel-source-azure important 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C 7.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H