Every CVE Search/ Get API key

CVE-2018-17336

UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing...

7.8 HighFix available

CVE-2018-17336 is a high vulnerability (CVSS 7.8) in Freedesktop Udisks, published September 22, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in udisks2 2.8.1-1.

UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.62%Down 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.

Record
CVE-2018-17336
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-134
Updated
2026-11-02
CVE List No score

UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.

Record
CVE-2018-17336
Updated
2026-11-02
EUVDEUVD-2018-9091 No score

UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.

Record
EUVD-2018-9091
Updated
2026-11-03
GitHub AdvisoriesGHSA-wc77-2q7w-jfm4 7.8

UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing...

UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.

Record
GHSA-wc77-2q7w-jfm4
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-134
Updated
2026-11-02
OSV 7.8

UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.

Record
CVE-2018-17336
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-17336 7.8

UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.

Record
DEBIAN-CVE-2018-17336
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2019:2178 7.5

Red Hat Security Advisory: udisks2 security, bug fix, and enhancement update

Record
RHSA-2019:2178
CVSS 3.0
7.5 HighCVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-17336 7.8

UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.

Record
UBUNTU-CVE-2018-17336
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:11479-1 No score

libudisks2-0-2.9.2-1.6 on GA media

These are all security issues fixed in the libudisks2-0-2.9.2-1.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11479-1
Updated
2026-11-02
OSVSUSE-SU-2018:3278-1 No score

Security update for udisks2

This update for udisks2 fixes the following issues:

Following security issues was fixed:

  • CVE-2018-17336: A format string vulnerability in udisks_log (bsc#1109406)

Following non-security issues were fixed:

  • strip trailing newline from sysfs raid level information (bsc#1091274)
  • Fix watcher error for non-redundant raid devices. (bsc#1091274)
Record
SUSE-SU-2018:3278-1
Updated
2026-11-02
OSVUSN-3772-1 No score

udisks2 vulnerability

It was discovered that UDisks incorrectly handled format strings when logging. A local attacker could possibly use this issue to cause a denial of service or obtain sensitive information.

Record
USN-3772-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
udisks2
Debian:12
 before 2.8.1-1
2.8.1-1
udisks2
Debian:13
 before 2.8.1-1
2.8.1-1
udisks2
Debian:14
 before 2.8.1-1
2.8.1-1
libudisks2
Red Hat:enterprise_linux:7::client
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2
Red Hat:enterprise_linux:7::client
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-iscsi
Red Hat:enterprise_linux:7::client
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-lsm
Red Hat:enterprise_linux:7::client
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-lvm2
Red Hat:enterprise_linux:7::client
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
libudisks2-devel
Red Hat:enterprise_linux:7::client
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
Show 24 moreShow less
Affected packages
PackageAffectedFixed
libudisks2
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-iscsi
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-lsm
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-lvm2
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
libudisks2-devel
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
libudisks2
Red Hat:enterprise_linux:7::server
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2
Red Hat:enterprise_linux:7::server
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-iscsi
Red Hat:enterprise_linux:7::server
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-lsm
Red Hat:enterprise_linux:7::server
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-lvm2
Red Hat:enterprise_linux:7::server
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
libudisks2-devel
Red Hat:enterprise_linux:7::server
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
libudisks2
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-iscsi
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-lsm
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2-lvm2
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
libudisks2-devel
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.3-9.el7
0:2.7.3-9.el7
udisks2
SUSE:Linux Enterprise Module for Basesystem 15
 before 2.6.5-3.7.2
2.6.5-3.7.2
udisks2
Ubuntu:18.04:LTS
 before 2.7.6-3ubuntu0.2, plus listed versions
2.6.5-2ubuntu22.6.5-2ubuntu32.7.6-2ubuntu42.7.6-2ubuntu62.7.6-32.7.6-3ubuntu0.1
2.7.6-3ubuntu0.2
udisks2
openSUSE:Tumbleweed
 before 2.9.2-1.6
2.9.2-1.6

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open