CVE-2018-18021

Name	CVE-2018-18021
Description	arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation does not prevent unintended execution modes.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1715-1, DSA-4313-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	bullseye	5.10.223-1	fixed
	bullseye (security)	5.10.226-1	fixed
	bookworm	6.1.115-1	fixed
	bookworm (security)	6.1.119-1	fixed
	trixie	6.12.5-1	fixed
	sid	6.12.6-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
linux	source	stretch	4.9.110-3+deb9u6	DSA-4313-1
linux	source	(unstable)	4.18.10-2
linux-4.9	source	jessie	4.9.144-3.1~deb8u1	DLA-1715-1

Notes

[jessie] - linux <ignored> (arm64 not supported in jessie LTS)
https://git.kernel.org/linus/d26c25a9d19b5976b319af528886f89cf455692d
https://git.kernel.org/linus/2a3f93459d689d990b3ecfbe782fec89b97d3279