PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2018-20855

CVE-2018-20855

kernel: Information leak in create_qp_common in drivers/infiniband/hw/mlx5/qp.c

Loading…

Severity

Moderate

Red Hat Product Security

3.3

CVSS 3.0

Review impact separately from score.

Published · July 26, 2019

Updated · June 28, 2026

Description

A flaw was discovered in the Linux kernel's implementation of InfiniBand. A local attacker who is able to execute a read from the InfiniBand device could trigger an information leak of kernel memory to userspace which can be used to further attack the system.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

If the InfiniBand device is in use, there is no known mitigation for this flaw. If the InfiniBand device is not in use, the kernel module (mlx5_ib) can be blacklisted and unloaded.

CVSS / CWE

CVSS 3.0 · 3.3
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor