Fixed
Created: Feb 14, 2019
Updated: Mar 13, 2019
Resolved Date: Mar 6, 2019
Found In Version: unknown
Fix Version: 10.18.44.5
Severity: Standard
Applicable for: Wind River Linux LTS 18
Component/s: Kernel
A use after free issue was found in the way Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvm_ioctl_create_device(), device holds a reference to a VM object, latter this reference is transferred to caller's file descriptor table. If such file descriptor was to be closed, reference count to the VM object could become zero, potentially leading to use-after-free issue latter.
https://nvd.nist.gov/vuln/detail/CVE-2019-6974
