cbcvebase.
CVE-2018-18955
published 2018-11-16

CVE-2018-18955: In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user…

PriorityP346high7CVSS 3.0
AVLACHPRLUINSUCHIHAH
EXPLOIT
EPSS
7.61%
93.8th percentile
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.

Affected

10 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debianlinux< linux 4.18.20-1 (bookworm)linux 4.18.20-1 (bookworm)
linuxlinux_kernel>= 0 < 4.18.20-14.18.20-1
linuxlinux_kernel>= 0 < 4.18.20-14.18.20-1
linuxlinux_kernel>= 0 < 4.18.20-14.18.20-1
linuxlinux_kernel>= 0 < 4.18.20-14.18.20-1
linuxlinux_kernel>= 0 < 4.15.0-42.454.15.0-42.45
linuxlinux_kernel>= 4.15 < 4.19.24.19.2

CVSS provenance

nvdv3.07.0HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
vendor_ubuntu7.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.