CVE-2018-17336: High severity Freedesktop udisks vulnerability
Last updated 25 August 2025
Other sources
UDisks 2.8.0 has a format string vulnerability in udiskslog in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-17336?
CVE-2018-17336 is a format string vulnerability in UDisks 2.8.0 that allows attackers to obtain sensitive information, cause a denial of service, or have other unspecified impact.
What is the severity of CVE-2018-17336?
The severity of CVE-2018-17336 is high, with a CVSS score of 7.8.
How can attackers exploit CVE-2018-17336?
Attackers can exploit CVE-2018-17336 by using a malformed filesystem label with format string specifiers such as %d or %n.
What is the affected software?
The affected software includes UDisks 2.8.0 on Ubuntu 18.04 LTS and UDisks 2.8.0 on Canonical Ubuntu Linux. The exact versions may vary.
How can I fix CVE-2018-17336?
To fix CVE-2018-17336, it is recommended to update UDisks to version 2.8.1-4 or later.