CVE-2018-20855 Information disclosure in n/a
A Linux kernel vulnerability allows local attackers to read uninitialized stack memory, potentially exposing sensitive kernel data to userspace.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20855?
CVE-2018-20855 is a low-severity vulnerability in Linux kernel, published on 26 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace.
Weakness: CWE-119
Which versions are affected by CVE-2018-20855?
It affects 6 products.
Products include Linux kernel, Netapp Active Iq Performance Analytics Services, Netapp Active Iq Unified Manager, Netapp Data Availability Services, Netapp Element Software, Opensuse Leap.
How do I fix CVE-2018-20855?
Apply the vendor's patch.
Is CVE-2018-20855 being exploited?
There is no known exploitation of CVE-2018-20855 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2018-20855, GHSA-xr6p-4wfc-3fxp.