peter bassill · operator
$ cve CVE-2018-17182 JSON

CVE-2018-17182 EXPLOIT

7.8
HIGH · CVSS 3.1 · EPSS 3.2% (pctl 88)

Patch early

A public exploit exists.

Description

An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.

Scoring

CVSS7.8 (HIGH, v3.1)
VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS3.21% — more likely to be exploited than 88% of all CVEs
WeaknessCWE-416
On CISA KEVno
Public exploityes
Published2018-09-19
Last modified2026-06-17

Affected (5)

VendorProduct
canonicalubuntu linux
debiandebian linux
linuxlinux kernel
netappactive iq performance analytics services
netappelement software

Public exploits

SourceTitleDate
exploit-dbLinux Kernel - VMA Use-After-Free via Buggy vmacache_flush_all() Fastpath Local Privilege Escalation2018-09-26

References

→ the Explorer  ·  watch your stack  ·  NVD