vulnwire
7.0high

CVE-2018-189557 exploits

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mish…

Published 7 y ago · modified 4 mo ago · JSON

CVSS
7.0
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
7.7%
percentile 95%
Public exploits
7
Metasploit · Exploit-DB

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.

Exploit prediction (EPSS)

7.67% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

Exploits and detections

  • Metasploit exploit/linux/local/nested_namespace_idmap_limit_priv_esc Linux Nested User Namespace idmap Limit Local Privilege Escalation · metasploit exploit, great rank · 2018-11-15
  • EDB-47167 Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method) · local · 2019-01-04
  • EDB-47166 Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method) · local · 2018-11-21
  • EDB-47165 Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method) · local · 2019-01-04
  • EDB-47164 Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method) · local · 2018-11-21
  • EDB-45915 Linux - Nested User Namespace idmap Limit Local Privilege Escalation (Metasploit) · local · 2018-11-29
  • EDB-45886 Linux - Broken uid/gid Mapping for Nested User Namespaces · local · 2018-11-16

CVSS scores

Assigned byVersionScoreVector
NVD3.07.0CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.04.4AV:L/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
Technology feeds
Linux kernel (RSS, critical only)

References

  • github.com /torvalds/linux/commit/d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd · x_refsource_MISC, x_transferred
  • cdn.kernel.org /pub/linux/kernel/v4.x/ChangeLog-4.18.19 · x_refsource_MISC, x_transferred
  • usn.ubuntu.com /3836-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • usn.ubuntu.com /3835-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • bugs.chromium.org /p/project-zero/issues/detail?id=1712 · x_refsource_MISC, x_transferred
  • git.kernel.org /cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d2f007dbe7e4c9583eea6eb04d60001e85c6f · x_refsource_MISC, x_transferred
  • usn.ubuntu.com /3833-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • usn.ubuntu.com /3832-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • exploit-db.com /exploits/45915/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • cdn.kernel.org /pub/linux/kernel/v4.x/ChangeLog-4.19.2 · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/45886/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • usn.ubuntu.com /3836-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • securityfocus.com /bid/105941 · vdb-entry, x_refsource_BID, x_transferred
  • support.f5.com /csp/article/K39103040 · x_refsource_CONFIRM, x_transferred
  • security.netapp.com /advisory/ntap-20190416-0003/ · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.