7

CVE-2018-18955

Exploit
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.2
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.10
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.61% 0.938
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7 1 5.9
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.4 3.4 6.4
AV:L/AC:M/Au:N/C:P/I:P/A:P
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://usn.ubuntu.com/3832-1/
Third Party Advisory
https://usn.ubuntu.com/3835-1/
Third Party Advisory
https://usn.ubuntu.com/3833-1/
Third Party Advisory
https://usn.ubuntu.com/3836-1/
Third Party Advisory
https://usn.ubuntu.com/3836-2/
Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd
Patch
Vendor Advisory
http://www.securityfocus.com/bid/105941
Third Party Advisory
VDB Entry
https://bugs.chromium.org/p/project-zero/issues/detail?id=1712
Patch
Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.19
Patch
Vendor Advisory
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.2
Patch
Vendor Advisory
https://github.com/torvalds/linux/commit/d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd
Patch
Vendor Advisory
https://security.netapp.com/advisory/ntap-20190416-0003/
https://support.f5.com/csp/article/K39103040
https://www.exploit-db.com/exploits/45886/
Patch
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/45915/
Third Party Advisory
Exploit
VDB Entry