CVE-2018-14625
kernel: use-after-free Read in vhost_transport_send_pkt
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · July 30, 2018
Updated · November 2, 2026
Description
A flaw was found where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly impersonate AF_VSOCK messages destined to other clients or leak kernel memory.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 5.3CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization