USN-3833-1: Linux kernel (AWS) vulnerabilities

Published Nov 30, 2018

Updated

Jann Horn discovered that the Linux kernel mishandles mapping UID or GID ranges inside nested user namespaces in some situations. A local attacker could use this to bypass access controls on resources outside the namespace. (CVE-2018-18955) Philipp Wendler discovered that the overlayfs implementation in the Linux kernel did not properly verify the directory contents permissions from within a unprivileged user namespace. A local attacker could use this to expose sensitive information (protected file names). (CVE-2018-6559)

Affected Software

1 affected component

Ubuntu Linux kernel (AWS)

Event History

May 9, 2025

Advisory Published

via Ubuntu·11:48 PM

Data Sourced

via Ubuntu·11:48 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID for this advisory?

The vulnerability ID for this advisory is CVE-2018-18955.

What is the severity of CVE-2018-18955?

The severity of CVE-2018-18955 is not mentioned in the advisory.

How can a local attacker exploit CVE-2018-18955?

A local attacker could exploit CVE-2018-18955 by using it to bypass access controls on resources outside the namespace.

Which version of Linux kernel fixes CVE-2018-18955?

The Linux kernel version 4.15.0-1029.30 specifically fixes CVE-2018-18955.

Where can I find more information about CVE-2018-18955?

You can find more information about CVE-2018-18955 at the following URL: https://ubuntu.com/security/CVE-2019-18955