CVE-2018-20168

Published: Dec 17, 2018Modified: Nov 21, 2024

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service ("physical address not valid" panic) via a crafted application.

Affected (1)

Products: Google: Gvisor

Google

1 product

Gvisor

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Gvisor	Before 2018-08-22

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://bugs.chromium.org/p/project-zero/issues/detail?id=1674

Source: cve@mitre.org

PatchVendor Advisory

https://bugs.chromium.org/p/project-zero/issues/detail?id=1674

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.