CVE-2018-14625

What it actually does

Race condition between connect() and close() in AF_VSOCK allows uncontrolled kernel-memory read from a VM guest, resulting in a 4-byte information leak or the ability to intercept or corrupt AF_VSOCK messages destined for other clients.

Why it matters to the business

Attackers inside a virtual machine may obtain small amounts of sensitive kernel data or disrupt inter-VM communication, increasing risk of information disclosure or service interference in virtualized environments; the issue has been public for years with low exploitability signals and no known ransomware use.

How an attack unfolds

An attacker with access to a VM guest opens an AF_VSOCK socket and triggers a race between connect() and close() to read kernel memory or tamper with messages intended for other clients; no named threat actors or campaigns are associated with this flaw.

How to fix it

Apply kernel updates that resolve the AF_VSOCK race condition; for listed distributions upgrade imagemagick to the specified fixed versions such as 8:6.9.9.34+dfsg-3 on Debian 11/12/13 or 8:6.8.9.9-7ubuntu5.14 on Ubuntu 16.04 LTS and 8:6.9.7.4+dfsg-16ubuntu6.7 on Ubuntu 18.04 LTS.

How to confirm the fix worked

Confirm the running kernel or package version meets or exceeds the listed fixed releases and test that AF_VSOCK sockets no longer permit the described race under concurrent connect/close workloads.

Typical attack path

1. Obtain local access inside a VM guest
2. Create an AF_VSOCK socket
3. Trigger concurrent connect() and close() operations to win the race
4. Read leaked kernel bytes or intercept/corrupt messages

How to detect it

Review kernel logs and audit records for unusual AF_VSOCK socket activity or repeated connect/close patterns from guest processes; no specific threat-actor indicators are known.

What your security team should do

• Prioritize patching systems that expose AF_VSOCK or run untrusted VM guests
• Verify installed kernel and package versions against the fixed releases provided
• Monitor for any future EPSS increase given the public disclosure age