Satheesh575555 / linux-4.1.15_CVE-2022-42703

Other
0 stars 0 forks source link

CVE-2018-18955 (High) detected in linuxlinux-4.6 - autoclosed #836

Closed mend-bolt-for-github[bot] closed 7 months ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2018-18955 - High Severity Vulnerability

Vulnerable Library - linuxlinux-4.6

The Linux Kernel

Library home page: https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/?wsslib=linux

Found in HEAD commit: 5efa23eac0f04571d486a6f7706fccc426b46cac

Found in base branch: master

Vulnerable Source Files (2)

/kernel/user_namespace.c /kernel/user_namespace.c

Vulnerability Details

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.

Publish Date: 2018-11-16

URL: CVE-2018-18955

CVSS 3 Score Details (7.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-18955

Release Date: 2018-11-16

Fix Resolution: linux-yocto - 5.4.20+gitAUTOINC+c11911d4d1_f4d7dbafb1,4.8.26+gitAUTOINC+1c60e003c7_27efc3ba68


Step up your Open Source Security Game with Mend here