CVE-2018-18955: High severity Linux Linux kernel vulnerability
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, mapwrite() in kernel/usernamespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAPSYSADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 7.1.13-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.19.2
Event History
Frequently Asked Questions
What is the severity of CVE-2018-18955?
CVE-2018-18955 has a severity rating of medium due to its potential for privilege escalation.
How do I fix CVE-2018-18955?
To fix CVE-2018-18955, update your Linux kernel to version 4.19.2 or higher.
Which versions of the Linux kernel are affected by CVE-2018-18955?
CVE-2018-18955 affects Linux kernel versions 4.15.x through 4.19.x before 4.19.2.
What causes the vulnerability in CVE-2018-18955?
The vulnerability in CVE-2018-18955 is caused by the mishandling of nested user namespaces with more than five UID or GID ranges.
Who can exploit CVE-2018-18955?
A user with CAP_SYS_ADMIN in an affected user namespace can exploit CVE-2018-18955 to bypass access controls.