peter bassill · operator
$ cve CVE-2018-18955 JSON

CVE-2018-18955 EXPLOIT

7.0
HIGH · CVSS 3.0 · EPSS 7.6% (pctl 94)

Patch early

A public exploit exists.

Description

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.

Scoring

CVSS7.0 (HIGH, v3.0)
VectorCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS7.61% — more likely to be exploited than 94% of all CVEs
WeaknessCWE-863
On CISA KEVno
Public exploityes
Published2018-11-16
Last modified2026-06-17

Affected (2)

VendorProduct
canonicalubuntu linux
linuxlinux kernel

Public exploits

SourceTitleDate
exploit-dbLinux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method)2019-01-04
exploit-dbLinux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method)2019-01-04
exploit-dbLinux - Nested User Namespace idmap Limit Local Privilege Escalation (Metasploit)2018-11-29
exploit-dbLinux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method)2018-11-21
exploit-dbLinux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method)2018-11-21
exploit-dbLinux - Broken uid/gid Mapping for Nested User Namespaces2018-11-16

References

→ the Explorer  ·  watch your stack  ·  NVD