{"id":"CVE-2018-15471","aliases":["BELL-CVE-2018-15471","DEBIAN-CVE-2018-15471","DLA-1715-1","DSA-4313-1","EUVD-2018-7349","GHSA-qv83-77rj-635j","MGASA-2018-0417","MGASA-2018-0418","MGASA-2018-0419","SUSE-SU-2018:2677-1","SUSE-SU-2018:2678-1","SUSE-SU-2018:2933-1","SUSE-SU-2018:2935-1","UBUNTU-CVE-2018-15471","USN-3820-1","USN-3820-2","USN-3820-3"],"status":"published","title":"An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux...","description":"An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00328,"percentile":0.26112,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2018-08-17T00:00:00Z","modified":"2026-10-23T18:03:00Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.18.10-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.18.10-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.18.10-2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Live Patching 15","package":"kernel-livepatch-SLE15_Update_1","fixed_in":["3-2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Live Patching 15","package":"kernel-livepatch-SLE15_Update_0","fixed_in":["3-7.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-azure","fixed_in":["4.15.0-1031.32~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-azure","fixed_in":["4.15.0-1031.32~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-azure-edge","fixed_in":["4.18.0-1006.6~16.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-gcp","fixed_in":["4.15.0-1024.25~16.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","fixed_in":["4.15.0-39.42~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux","fixed_in":["4.15.0-39.42"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws","fixed_in":["4.15.0-1027.27"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","fixed_in":["4.15.0-1031.32"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","fixed_in":["4.15.0-1024.25"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-kvm","fixed_in":["4.15.0-1026.26"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","fixed_in":["4.15.0-1026.31"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-raspi2","fixed_in":["4.15.0-1028.30"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.10-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.10-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.10-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"linux-4.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.144-3.1~deb8u1"}]}],"versions":["4.9.110-1~deb8u1"],"bundled":27},{"source":"osv","ecosystem":"Debian:9","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.110-3+deb9u6"}]}],"versions":["4.9.107-1","4.9.110-1","4.9.110-2","4.9.110-3","4.9.110-3+deb9u1","4.9.110-3+deb9u2","4.9.110-3+deb9u3","4.9.110-3+deb9u4","4.9.110-3+deb9u5","4.9.30-2","4.9.30-2+deb9u1","4.9.30-2+deb9u2","4.9.30-2+deb9u2~bpo8+1","4.9.30-2+deb9u3","4.9.30-2+deb9u4","4.9.30-2+deb9u5","4.9.30-2+deb9u5~bpo8+1","4.9.47-1","4.9.51-1","4.9.51-1~bpo8+1","4.9.65-1","4.9.65-2","4.9.65-3","4.9.65-3+deb9u1","4.9.65-3+deb9u1~bpo8+1","4.9.65-3+deb9u2","4.9.65-3+deb9u2~bpo8+1","4.9.65-3~bpo8+1","4.9.80-1","4.9.80-2","4.9.82-1+deb9u2","4.9.82-1+deb9u3","4.9.82-1+deb9u3~bpo8+1","4.9.88-1","4.9.88-1+deb9u1","4.9.88-1+deb9u1~bpo8+1","4.9.88-1~bpo8+1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.78-1.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:6","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.78-1.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.18-10.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.18-10.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-70.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:6","package":"wireguard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20181018-1.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:6","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.78-1.mga6"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.78-1.mga6"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15","package":"kernel-livepatch-SLE15_Update_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15","package":"kernel-livepatch-SLE15_Update_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3-7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15","package":"kernel-livepatch-SLE15_Update_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15","package":"kernel-livepatch-SLE15_Update_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3-7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15","package":"kernel-livepatch-SLE15_Update_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15","package":"kernel-livepatch-SLE15_Update_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2-2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15","package":"kernel-livepatch-SLE15_Update_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3-2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1031.32~14.04.1"}]}],"versions":["4.15.0-1023.24~14.04.1","4.15.0-1030.31~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1031.32~16.04.1"}]}],"versions":["4.11.0-1009.9","4.11.0-1011.11","4.11.0-1013.13","4.11.0-1014.14","4.11.0-1015.15","4.11.0-1016.16","4.13.0-1005.7","4.13.0-1006.8","4.13.0-1007.9","4.13.0-1009.12","4.13.0-1011.14","4.13.0-1012.15","4.13.0-1014.17","4.13.0-1016.19","4.13.0-1018.21","4.15.0-1013.13~16.04.2","4.15.0-1014.14~16.04.1","4.15.0-1018.18~16.04.1","4.15.0-1019.19~16.04.1","4.15.0-1021.21~16.04.1","4.15.0-1022.22~16.04.1","4.15.0-1023.24~16.04.1","4.15.0-1025.26~16.04.1","4.15.0-1028.29~16.04.1","4.15.0-1030.31~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-1006.6~16.04.2"}]}],"versions":["4.13.0-1003.3","4.13.0-1005.5","4.14.0-1003.3","4.15.0-1005.5","4.15.0-1012.12~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1024.25~16.04.2"}]}],"versions":["4.10.0-1004.4","4.10.0-1006.6","4.10.0-1007.7","4.10.0-1008.8","4.10.0-1009.9","4.13.0-1002.5","4.13.0-1006.9","4.13.0-1007.10","4.13.0-1008.11","4.13.0-1011.15","4.13.0-1012.16","4.13.0-1013.17","4.13.0-1015.19","4.13.0-1017.21","4.13.0-1019.23","4.15.0-1014.14~16.04.1","4.15.0-1015.15~16.04.1","4.15.0-1017.18~16.04.1","4.15.0-1018.19~16.04.2","4.15.0-1019.20~16.04.1","4.15.0-1021.22~16.04.1","4.15.0-1023.24~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-39.42~16.04.1"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1","4.10.0-32.36~16.04.1","4.10.0-33.37~16.04.1","4.10.0-35.39~16.04.1","4.10.0-37.41~16.04.1","4.10.0-38.42~16.04.1","4.10.0-40.44~16.04.1","4.10.0-42.46~16.04.1","4.13.0-26.29~16.04.2","4.13.0-31.34~16.04.1","4.13.0-32.35~16.04.1","4.13.0-36.40~16.04.1","4.13.0-37.42~16.04.1","4.13.0-38.43~16.04.1","4.13.0-39.44~16.04.1","4.13.0-41.46~16.04.1","4.13.0-43.48~16.04.1","4.13.0-45.50~16.04.1","4.15.0-24.26~16.04.1","4.15.0-29.31~16.04.1","4.15.0-30.32~16.04.1","4.15.0-32.35~16.04.1","4.15.0-33.36~16.04.1","4.15.0-34.37~16.04.1","4.15.0-36.39~16.04.1","4.15.0-38.41~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-39.42"}]}],"versions":["4.13.0-16.19","4.13.0-17.20","4.13.0-25.29","4.13.0-32.35","4.15.0-10.11","4.15.0-12.13","4.15.0-13.14","4.15.0-15.16","4.15.0-19.20","4.15.0-20.21","4.15.0-22.24","4.15.0-23.25","4.15.0-24.26","4.15.0-29.31","4.15.0-30.32","4.15.0-32.35","4.15.0-33.36","4.15.0-34.37","4.15.0-36.39","4.15.0-38.41"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1027.27"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1007.7","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1031.32"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1024.25"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1026.26"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1012.12","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1026.31"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1028.30"}]}],"versions":["4.13.0-1005.5","4.13.0-1006.6","4.13.0-1008.8","4.15.0-1006.7","4.15.0-1009.10","4.15.0-1010.11","4.15.0-1011.12","4.15.0-1012.13","4.15.0-1013.14","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1020.22","4.15.0-1021.23","4.15.0-1022.24","4.15.0-1024.26","4.15.0-1026.28","4.15.0-1027.29"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-39.42"}]}],"versions":["4.13.0-16.19","4.13.0-17.20","4.13.0-25.29","4.13.0-32.35","4.15.0-10.11","4.15.0-12.13","4.15.0-13.14","4.15.0-15.16","4.15.0-19.20","4.15.0-20.21","4.15.0-22.24","4.15.0-23.25","4.15.0-24.26","4.15.0-29.31","4.15.0-30.32","4.15.0-32.35","4.15.0-33.36","4.15.0-34.37","4.15.0-36.39","4.15.0-38.41"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1027.27"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1007.7","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1031.32"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1024.25"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1026.26"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1012.12","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1026.31"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1028.30"}]}],"versions":["4.13.0-1005.5","4.13.0-1006.6","4.13.0-1008.8","4.15.0-1006.7","4.15.0-1009.10","4.15.0-1010.11","4.15.0-1011.12","4.15.0-1012.13","4.15.0-1013.14","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1020.22","4.15.0-1021.23","4.15.0-1022.24","4.15.0-1024.26","4.15.0-1026.28","4.15.0-1027.29"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1031.32~16.04.1"}]}],"versions":["4.11.0-1009.9","4.11.0-1011.11","4.11.0-1013.13","4.11.0-1014.14","4.11.0-1015.15","4.11.0-1016.16","4.13.0-1005.7","4.13.0-1006.8","4.13.0-1007.9","4.13.0-1009.12","4.13.0-1011.14","4.13.0-1012.15","4.13.0-1014.17","4.13.0-1016.19","4.13.0-1018.21","4.15.0-1013.13~16.04.2","4.15.0-1014.14~16.04.1","4.15.0-1018.18~16.04.1","4.15.0-1019.19~16.04.1","4.15.0-1021.21~16.04.1","4.15.0-1022.22~16.04.1","4.15.0-1023.24~16.04.1","4.15.0-1025.26~16.04.1","4.15.0-1028.29~16.04.1","4.15.0-1030.31~16.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1024.25~16.04.2"}]}],"versions":["4.10.0-1004.4","4.10.0-1006.6","4.10.0-1007.7","4.10.0-1008.8","4.10.0-1009.9","4.13.0-1002.5","4.13.0-1006.9","4.13.0-1007.10","4.13.0-1008.11","4.13.0-1011.15","4.13.0-1012.16","4.13.0-1013.17","4.13.0-1015.19","4.13.0-1017.21","4.13.0-1019.23","4.15.0-1014.14~16.04.1","4.15.0-1015.15~16.04.1","4.15.0-1017.18~16.04.1","4.15.0-1018.19~16.04.2","4.15.0-1019.20~16.04.1","4.15.0-1021.22~16.04.1","4.15.0-1023.24~16.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-39.42~16.04.1"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1","4.10.0-32.36~16.04.1","4.10.0-33.37~16.04.1","4.10.0-35.39~16.04.1","4.10.0-37.41~16.04.1","4.10.0-38.42~16.04.1","4.10.0-40.44~16.04.1","4.10.0-42.46~16.04.1","4.13.0-26.29~16.04.2","4.13.0-31.34~16.04.1","4.13.0-32.35~16.04.1","4.13.0-36.40~16.04.1","4.13.0-37.42~16.04.1","4.13.0-38.43~16.04.1","4.13.0-39.44~16.04.1","4.13.0-41.46~16.04.1","4.13.0-43.48~16.04.1","4.13.0-45.50~16.04.1","4.15.0-24.26~16.04.1","4.15.0-29.31~16.04.1","4.15.0-30.32~16.04.1","4.15.0-32.35~16.04.1","4.15.0-33.36~16.04.1","4.15.0-34.37~16.04.1","4.15.0-36.39~16.04.1","4.15.0-38.41~16.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1031.32~14.04.1"}]}],"versions":["4.15.0-1023.24~14.04.1","4.15.0-1030.31~14.04.1"],"bundled":4}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"linux","product":"linux_kernel"},{"vendor":"xen","product":"xen"}],"references":[{"url":"https://usn.ubuntu.com/3820-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-270.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3820-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=1607","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2018/dsa-4313","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3819-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3820-3/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15471"},{"url":"https://github.com/advisories/GHSA-qv83-77rj-635j"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-15471","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-15471","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0417.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23687","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.71","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.72","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.73","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.74","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.75","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.76","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.77","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.78","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0418.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23688","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.70","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0419.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23689","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182677-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1105026","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15471","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182678-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1097108","tags":["report"]},{"url":"https://bugzilla.suse.com/1103203","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10853","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182933-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182935-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1106191","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10938","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-15471","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-270.html","tags":["report"]},{"url":"https://www.spinics.net/lists/netdev/msg520271.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3820-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3819-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3820-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3820-3","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-15471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-9363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16658","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-15471","description":"An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks.","status":"published","published":"2018-08-17T17:00:00Z","modified":"2024-08-05T09:54:03.602Z","updated_at":"2026-11-02T14:35:03.825765Z"}],"euvd":[{"id":"EUVD-2018-7349","description":"An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks.","status":"published","published":"2018-08-17T17:00:00Z","modified":"2024-08-05T09:54:03Z","updated_at":"2026-11-03T02:39:44.728742Z"}],"ghsa":[{"id":"GHSA-qv83-77rj-635j","title":"An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux...","description":"An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks.","status":"published","published":"2022-05-13T01:19:10Z","modified":"2023-02-01T05:05:45Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:50:16.912878Z"}],"nvd":[{"id":"CVE-2018-15471","description":"An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks.","status":"published","published":"2018-08-17T18:29:01.1Z","modified":"2026-06-17T01:42:34.717Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:L/AC:L/Au:S/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:04:36.842579Z"}],"osv":[{"id":"BELL-CVE-2018-15471","title":"CVE-2018-15471 does not affect BellSoft software","status":"withdrawn","published":"2018-08-17T18:29:00Z","modified":"2026-01-26T09:50:03.892164Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-15471","description":"An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks.","status":"published","published":"2018-08-17T18:29:01.1Z","modified":"2026-04-16T06:21:55.416049572Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-15471","description":"An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks.","status":"published","published":"2018-08-17T18:29:01.1Z","modified":"2026-10-23T18:03:00.052736581Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-15471","description":"An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks.","status":"published","published":"2018-08-17T00:00:00Z","modified":"2026-04-22T11:45:56.204333Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"DLA-1715-1","title":"linux-4.9 - security update","status":"published","published":"2019-03-14T00:00:00Z","modified":"2026-03-09T01:21:20.541349Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4313-1","title":"linux - security update","status":"published","published":"2018-10-08T00:00:00Z","modified":"2026-03-09T02:09:03.383383Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0417","title":"Updated kernel packages fix security vulnerabilities","description":"This kernel update is based on the upstream 4.14.78 and fixes at least the\nfollowing security issues:\n\nAn issue was discovered in the fd_locked_ioctl function in\ndrivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy\ndriver will copy a kernel pointer to user memory in response to the\nFDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the\nobtained kernel pointer to discover the location of kernel code and data\nand bypass kernel security protections such as KASLR (CVE-2018-7755).\n\nA security flaw was found in the chap_server_compute_md5() function in the\nISCSI target code in the Linux kernel in a way an authentication request\nfrom an ISCSI initiator is processed. An unauthenticated remote attacker\ncan cause a stack buffer overflow and smash up to 17 bytes of the stack.\nThe attack requires the iSCSI target to be enabled on the victim host.\nDepending on how the target's code was built (i.e. depending on a compiler,\ncompile flags and hardware architecture) an attack may lead to a system\ncrash and thus to a denial-of-service or possibly to a non-authorized\naccess to data exported by an iSCSI target. Due to the nature of the flaw,\nprivilege escalation cannot be fully ruled out, although we believe it is\nhighly unlikely (CVE-2018-14633).\n\nAn issue was discovered in xenvif_set_hash_mapping in\ndrivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used\nin Xen through 4.11.x and other products. The Linux netback driver allows\nfrontends to control mapping of requests to request queues. When processing\na request to set or change this mapping, some input validation (e.g., for\nan integer overflow) was missing or flawed, leading to OOB access in hash\nhandling. A malicious or buggy frontend may cause the (usually privileged)\nbackend to make out of bounds memory accesses, potentially resulting in\none or more of privilege escalation, Denial of Service (DoS), or\ninformation leaks (CVE-2018-15471).\n\nSince Linux kernel version 3.2, the mremap() syscall performs TLB flushes\nafter dropping pagetable locks. If a syscall such as ftruncate() removes\nentries from the pagetables of a task that is in the middle of mremap(),\na stale TLB entry can remain for a short time that permits access to a\nphysical page after it has been released back to the page allocator and\nreused (CVE-2018-18281).\n\nIn the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before\n4.18.13, faulty computation of numeric bounds in the BPF verifier permits\nout-of-bounds memory accesses because adjust_scalar_min_max_vals in\nkernel/bpf/verifier.c mishandles 32-bit right shifts (CVE-2018-18445).\n\nOther fixes in this update:\n* WireGuard has been updated 0.0.20181018\n\nFor other uptstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2018-10-27T09:45:46Z","modified":"2026-04-16T06:24:00.092813151Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2018-0418","title":"Updated kernel-tmb packages fix security vulnerabilities","description":"This kernel-tmb update is based on the upstream 4.14.78 and adds additional\nfixes for the L1TF security issues. It also fixes at least the following\nsecurity issues:\n\nLinux kernel from versions 3.9 and up, is vulnerable to a denial of\nservice attack with low rates of specially modified packets targeting IP\nfragment re-assembly. An attacker may cause a denial of service condition\nby sending specially crafted IP fragments (CVE-2018-5391, FragmentSmack).\n\nAn issue was discovered in the fd_locked_ioctl function in\ndrivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy\ndriver will copy a kernel pointer to user memory in response to the\nFDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the\nobtained kernel pointer to discover the location of kernel code and data\nand bypass kernel security protections such as KASLR (CVE-2018-7755).\n\nA security flaw was found in the chap_server_compute_md5() function in the\nISCSI target code in the Linux kernel in a way an authentication request\nfrom an ISCSI initiator is processed. An unauthenticated remote attacker\ncan cause a stack buffer overflow and smash up to 17 bytes of the stack.\nThe attack requires the iSCSI target to be enabled on the victim host.\nDepending on how the target's code was built (i.e. depending on a compiler,\ncompile flags and hardware architecture) an attack may lead to a system\ncrash and thus to a denial-of-service or possibly to a non-authorized\naccess to data exported by an iSCSI target. Due to the nature of the flaw,\nprivilege escalation cannot be fully ruled out, although we believe it is\nhighly unlikely (CVE-2018-14633).\n\nA security flaw was found in the ip_frag_reasm() function in\nnet/ipv4/ip_fragment.c in the Linux kernel caused by fixes for\nCVE-2018-5391, which can cause a later system crash in ip_do_fragment().\nWith certain non-default, but non-rare, configuration of a victim host,\nan attacker can trigger this crash remotely, thus leading to a remote\ndenial-of-service (CVE-2018-14641).\n\nAn issue was discovered in xenvif_set_hash_mapping in\ndrivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used\nin Xen through 4.11.x and other products. The Linux netback driver allows\nfrontends to control mapping of requests to request queues. When processing\na request to set or change this mapping, some input validation (e.g., for\nan integer overflow) was missing or flawed, leading to OOB access in hash\nhandling. A malicious or buggy frontend may cause the (usually privileged)\nbackend to make out of bounds memory accesses, potentially resulting in\none or more of privilege escalation, Denial of Service (DoS), or\ninformation leaks (CVE-2018-15471).\n\nAn issue was discovered in the Linux kernel through 4.18.8. The\nvmacache_flush_all function in mm/vmacache.c mishandles sequence number\noverflows. An attacker can trigger a use-after-free (and possibly gain\nprivileges) via certain thread creation, map, unmap, invalidation, and\ndereference operations (CVE-2018-17182).\n\nSince Linux kernel version 3.2, the mremap() syscall performs TLB flushes\nafter dropping pagetable locks. If a syscall such as ftruncate() removes\nentries from the pagetables of a task that is in the middle of mremap(),\na stale TLB entry can remain for a short time that permits access to a\nphysical page after it has been released back to the page allocator and\nreused (CVE-2018-18281).\n\nIn the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before\n4.18.13, faulty computation of numeric bounds in the BPF verifier permits\nout-of-bounds memory accesses because adjust_scalar_min_max_vals in\nkernel/bpf/verifier.c mishandles 32-bit right shifts (CVE-2018-18445).\n\nOther fixes in this update:\n* WireGuard has been updated 0.0.20181018\n\nFor other uptstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2018-10-27T09:45:46Z","modified":"2026-04-16T06:26:25.356716384Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2018-0419","title":"Updated kernel-linus packages fix security vulnerabilities","description":"This kernel-linus update is based on the upstream 4.14.78 and adds additional\nfixes for the L1TF security issues. It also fixes at least the following\nsecurity issues:\n\nLinux kernel from versions 3.9 and up, is vulnerable to a denial of\nservice attack with low rates of specially modified packets targeting IP\nfragment re-assembly. An attacker may cause a denial of service condition\nby sending specially crafted IP fragments (CVE-2018-5391, FragmentSmack).\n\nMemory leak in the irda_bind function in net/irda/af_irda.c and later in\ndrivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows\nlocal users to cause a denial of service (memory consumption) by repeatedly\nbinding an AF_IRDA socket (CVE-2018-6554).\n\nThe irda_setsockopt function in net/irda/af_irda.c and later in\ndrivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows\nlocal users to cause a denial of service (ias_object use-after-free and\nsystem crash) or possibly have unspecified other impact via an AF_IRDA\nsocket (CVE-2018-6555).\n\nAn issue was discovered in the fd_locked_ioctl function in\ndrivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy\ndriver will copy a kernel pointer to user memory in response to the\nFDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the\nobtained kernel pointer to discover the location of kernel code and data\nand bypass kernel security protections such as KASLR (CVE-2018-7755).\n\nA security flaw was found in the chap_server_compute_md5() function in the\nISCSI target code in the Linux kernel in a way an authentication request\nfrom an ISCSI initiator is processed. An unauthenticated remote attacker\ncan cause a stack buffer overflow and smash up to 17 bytes of the stack.\nThe attack requires the iSCSI target to be enabled on the victim host.\nDepending on how the target's code was built (i.e. depending on a compiler,\ncompile flags and hardware architecture) an attack may lead to a system\ncrash and thus to a denial-of-service or possibly to a non-authorized\naccess to data exported by an iSCSI target. Due to the nature of the flaw,\nprivilege escalation cannot be fully ruled out, although we believe it is\nhighly unlikely (CVE-2018-14633).\n\nA security flaw was found in the ip_frag_reasm() function in\nnet/ipv4/ip_fragment.c in the Linux kernel caused by fixes for\nCVE-2018-5391, which can cause a later system crash in ip_do_fragment().\nWith certain non-default, but non-rare, configuration of a victim host,\nan attacker can trigger this crash remotely, thus leading to a remote\ndenial-of-service (CVE-2018-14641).\n\nAn issue was discovered in xenvif_set_hash_mapping in\ndrivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used\nin Xen through 4.11.x and other products. The Linux netback driver allows\nfrontends to control mapping of requests to request queues. When processing\na request to set or change this mapping, some input validation (e.g., for\nan integer overflow) was missing or flawed, leading to OOB access in hash\nhandling. A malicious or buggy frontend may cause the (usually privileged)\nbackend to make out of bounds memory accesses, potentially resulting in\none or more of privilege escalation, Denial of Service (DoS), or\ninformation leaks (CVE-2018-15471).\n\nAn issue was discovered in the Linux kernel through 4.18.8. The\nvmacache_flush_all function in mm/vmacache.c mishandles sequence number\noverflows. An attacker can trigger a use-after-free (and possibly gain\nprivileges) via certain thread creation, map, unmap, invalidation, and\ndereference operations (CVE-2018-17182).\n\nSince Linux kernel version 3.2, the mremap() syscall performs TLB flushes\nafter dropping pagetable locks. If a syscall such as ftruncate() removes\nentries from the pagetables of a task that is in the middle of mremap(),\na stale TLB entry can remain for a short time that permits access to a\nphysical page after it has been released back to the page allocator and\nreused (CVE-2018-18281).\n\nIn the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before\n4.18.13, faulty computation of numeric bounds in the BPF verifier permits\nout-of-bounds memory accesses because adjust_scalar_min_max_vals in\nkernel/bpf/verifier.c mishandles 32-bit right shifts (CVE-2018-18445).\n\nFor other uptstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2018-10-27T09:45:46Z","modified":"2026-04-16T06:25:48.402603999Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"SUSE-SU-2018:2677-1","title":"Security update for the Linux Kernel (Live Patch 0 for SLE 15)","description":"This update for the Linux Kernel 4.12.14-23 fixes one issue.\n\nThe following security issue was fixed:\n\n- CVE-2018-15471: An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c. The Linux netback driver allowed frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks (bsc#1105026).\n","status":"published","published":"2018-09-10T14:59:47Z","modified":"2026-02-04T02:57:20.059673Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2678-1","title":"Security update for the Linux Kernel (Live Patch 2 for SLE 15)","description":"This update for the Linux Kernel 4.12.14-25_6 fixes several issues.\n\nThe following security issues were fixed:\n\n- CVE-2018-15471: An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c. The Linux netback driver allowed frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks (bsc#1105026).\n- CVE-2018-10853: A KVM guest userspace to guest kernel write was fixed, which could be used by guest users to crash the guest kernel (bsc#1097108).\n","status":"published","published":"2018-09-10T14:59:41Z","modified":"2026-02-04T04:10:25.759738Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2933-1","title":"Security update for the Linux Kernel (Live Patch 3 for SLE 15)","description":"This update for the Linux Kernel 4.12.14-25_11 fixes several issues.\n\nThe following security issues were fixed:\n\n- CVE-2018-15471: An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c. The Linux netback driver allowed frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks (bsc#1105026).\n- CVE-2018-10853: A KVM guest userspace to guest kernel write was fixed, which could be used by guest users to crash the guest kernel (bsc#1097108).\n","status":"published","published":"2018-09-28T08:56:35Z","modified":"2026-02-04T03:10:09.759953Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2935-1","title":"Security update for the Linux Kernel (Live Patch 3 for SLE 15)","description":"This update for the Linux Kernel 4.12.14-25_13 fixes several issues.\n\nThe following security issues were fixed:\n\n- CVE-2018-10938: It was found that a crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipso_v4_optptr() function in net/ipv4/cipso_ipv4.c leading to a denial-of-service. A certain non-default configuration of LSM (Linux Security Module) and NetLabel should be set up on a system an attacker could leverage this flaw (bsc#1106191).\n- CVE-2018-15471: It was found that the netback driver allowed frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may caused the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks (bsc#1105026).\n- CVE-2018-10853: It was found that the KVM hypervisor emulated instructions did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest (bsc#1097108).\n","status":"published","published":"2018-09-28T12:49:41Z","modified":"2026-02-04T04:10:50.76052Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3820-1","title":"linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities","description":"Felix Wilhelm discovered that the Xen netback driver in the Linux kernel\ndid not properly perform input validation in some situations. An attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2018-15471)\n\nIt was discovered that the generic SCSI driver in the Linux kernel did not\nproperly enforce permissions on kernel memory access. A local attacker\ncould use this to expose sensitive information or possibly elevate\nprivileges. (CVE-2017-13168)\n\nIt was discovered that an integer overflow existed in the CD-ROM driver of\nthe Linux kernel. A local attacker could use this to expose sensitive\ninformation (kernel memory). (CVE-2018-16658)\n\nIt was discovered that an integer overflow existed in the HID Bluetooth\nimplementation in the Linux kernel that could lead to a buffer overwrite.\nAn attacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2018-9363)\n","status":"published","published":"2018-11-14T21:33:29Z","modified":"2026-04-22T09:52:16.827855Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-3820-2","title":"linux-hwe, linux-azure, linux-gcp vulnerabilities","description":"USN-3820-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu\n16.04 LTS.\n\nFelix Wilhelm discovered that the Xen netback driver in the Linux kernel\ndid not properly perform input validation in some situations. An attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2018-15471)\n\nIt was discovered that the generic SCSI driver in the Linux kernel did not\nproperly enforce permissions on kernel memory access. A local attacker\ncould use this to expose sensitive information or possibly elevate\nprivileges. (CVE-2017-13168)\n\nIt was discovered that an integer overflow existed in the CD-ROM driver of\nthe Linux kernel. A local attacker could use this to expose sensitive\ninformation (kernel memory). (CVE-2018-16658)\n\nIt was discovered that an integer overflow existed in the HID Bluetooth\nimplementation in the Linux kernel that could lead to a buffer overwrite.\nAn attacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2018-9363)\n","status":"published","published":"2018-11-14T22:06:17Z","modified":"2026-02-10T04:41:27Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-3820-3","title":"linux-azure vulnerabilities","description":"Felix Wilhelm discovered that the Xen netback driver in the Linux kernel\ndid not properly perform input validation in some situations. An attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2018-15471)\n\nIt was discovered that the generic SCSI driver in the Linux kernel did not\nproperly enforce permissions on kernel memory access. A local attacker\ncould use this to expose sensitive information or possibly elevate\nprivileges. (CVE-2017-13168)\n\nIt was discovered that an integer overflow existed in the CD-ROM driver of\nthe Linux kernel. A local attacker could use this to expose sensitive\ninformation (kernel memory). (CVE-2018-16658)\n\nIt was discovered that an integer overflow existed in the HID Bluetooth\nimplementation in the Linux kernel that could lead to a buffer overwrite.\nAn attacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2018-9363)\n","status":"published","published":"2018-11-14T22:55:36Z","modified":"2026-02-10T04:41:27Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}