Every CVE Search/ Get API key

CVE-2017-18018

CVE-2017-18018 does not affect BellSoft software

4.7 MediumFix available

CVE-2017-18018 is a medium vulnerability (CVSS 4.7) in Gnu Coreutils, published January 4, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in coreutils 8.30-r0.

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.34%Up 0.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List 7.1

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

Record
CVE-2017-18018
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-362
Updated
2026-11-02
EUVDEUVD-2017-9158 7.1

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

Record
EUVD-2017-9158
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
NVD 7.1

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

Record
CVE-2017-18018
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.0
4.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
1.9 LowAV:L/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-362
Updated
2026-11-02
OSVALPINE-CVE-2017-18018 4.7

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

Record
ALPINE-CVE-2017-18018
CVSS 3.0
4.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2017-18018 7.1

CVE-2017-18018 does not affect BellSoft software

Record
BELL-CVE-2017-18018
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSV 4.7

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

Record
CVE-2017-18018
CVSS 3.0
4.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2017-18018 4.7

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

Record
DEBIAN-CVE-2017-18018
CVSS 3.0
4.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2017-18018 7.1

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

Record
UBUNTU-CVE-2017-18018
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.0
4.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVMGASA-2019-0022 No score

Updated coreutils packages fix security vulnerabilities

A flaw was found in GNU Coreutils through 8.29 in chown-core.c. The functions chown and chgrp do not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition (CVE-2017-18018).

A flaw was found in Gnulib before 2018-09-23. The convert_to_decimal function in vasnprintf.c has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing (CVE-2018-17942).

Record
MGASA-2019-0022
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
coreutils
Alpine:v3.10
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.11
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.12
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.13
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.14
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.15
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.16
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.17
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.18
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.19
 before 8.30-r0
8.30-r0
Show 15 moreShow less
Affected packages
PackageAffectedFixed
coreutils
Alpine:v3.20
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.21
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.22
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.23
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.24
 before 8.30-r0
8.30-r0
coreutils
Alpine:v3.7
 before 8.28-r0
8.28-r0
coreutils
Alpine:v3.8
 before 8.29-r2
8.29-r2
coreutils
Alpine:v3.9
 before 8.30-r0
8.30-r0
coreutils
Debian:12
 All versions, plus listed versions
9.1-19.10-19.4-19.4-29.4-3
Show 7 moreShow less
9.4-3.19.5-19.6-19.6-29.7-19.7-29.7-3
 None known
coreutils
Debian:13
 All versions, plus listed versions
9.10-19.7-3
 None known
coreutils
Debian:14
 All versions, plus listed versions
9.10-19.7-3
 None known
coreutils
Mageia:6
 before 8.25-3.1.mga6
8.25-3.1.mga6
coreutils
Ubuntu:14.04:LTS
 All versions, plus listed versions
8.20-3ubuntu58.21-1ubuntu38.21-1ubuntu48.21-1ubuntu58.21-1ubuntu5.18.21-1ubuntu5.38.21-1ubuntu5.4
 None known
coreutils
Ubuntu:16.04:LTS
 All versions, plus listed versions
8.23-4ubuntu28.25-2ubuntu28.25-2ubuntu3~16.04
 None known
coreutils
Ubuntu:18.04:LTS
 All versions, plus listed versions
8.26-3ubuntu48.28-1ubuntu1
 None known

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, NVD, OSV

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open