Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 29 Oct 2018 16:11:34 +0100
From: Jann Horn <>
Subject: Linux kernel: TLB flush happens too late on mremap (CVE-2018-18281;
 fixed in 4.9.135, 4.14.78, 4.18.16, 4.19)

NOTE: I have requested a CVE identifier, and I'm sending this message,
to make tracking of the fix easier; however, to avoid missing security
fixes without CVE identifiers, you should *NOT* be cherry-picking a
specific patch in response to a notification about a kernel security

Since Linux kernel version 3.2, the mremap() syscall performs TLB
flushes after dropping pagetable locks. If a syscall such as
ftruncate() removes entries from the pagetables of a task that is in
the middle of mremap(), a stale TLB entry can remain for a short time
that permits access to a physical page after it has been released back
to the page allocator and reused.

This is CVE-2018-18281.

This is fixed in the following kernel versions:

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.