{"id":"CVE-2018-18955","aliases":["DEBIAN-CVE-2018-18955","EUVD-2018-10659","GHSA-c6xj-3c77-g5rg","UBUNTU-CVE-2018-18955","USN-3833-1","USN-3836-1","USN-3836-2"],"status":"published","title":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c...","description":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.","severity":{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07673,"percentile":0.9463,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-863"],"published":"2018-11-16T00:00:00Z","modified":"2026-10-23T18:03:03Z","exploits":[{"source":"metasploit","id":"exploit/linux/local/nested_namespace_idmap_limit_priv_esc","title":"Linux Nested User Namespace idmap Limit Local Privilege Escalation","type":"exploit","platform":"Linux","date":"2018-11-15","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/local/nested_namespace_idmap_limit_priv_esc"},{"source":"exploitdb","id":"EDB-45886","title":"Linux - Broken uid/gid Mapping for Nested User Namespaces","type":"local","platform":"linux","date":"2018-11-16","verified":true,"url":"https://www.exploit-db.com/exploits/45886"},{"source":"exploitdb","id":"EDB-47164","title":"Linux Kernel 4.15.x \u003c 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method)","type":"local","platform":"linux","date":"2018-11-21","url":"https://www.exploit-db.com/exploits/47164"},{"source":"exploitdb","id":"EDB-47166","title":"Linux Kernel 4.15.x \u003c 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method)","type":"local","platform":"linux","date":"2018-11-21","url":"https://www.exploit-db.com/exploits/47166"},{"source":"exploitdb","id":"EDB-45915","title":"Linux - Nested User Namespace idmap Limit Local Privilege Escalation (Metasploit)","type":"local","platform":"linux","date":"2018-11-29","verified":true,"url":"https://www.exploit-db.com/exploits/45915"},{"source":"exploitdb","id":"EDB-47165","title":"Linux Kernel 4.15.x \u003c 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method)","type":"local","platform":"linux","date":"2019-01-04","url":"https://www.exploit-db.com/exploits/47165"},{"source":"exploitdb","id":"EDB-47167","title":"Linux Kernel 4.15.x \u003c 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method)","type":"local","platform":"linux","date":"2019-01-04","url":"https://www.exploit-db.com/exploits/47167"},{"source":"pocgithub","id":"scheatkode/CVE-2018-18955","title":"scheatkode/CVE-2018-18955","date":"2022-01-19","url":"https://github.com/scheatkode/CVE-2018-18955"},{"source":"pocgithub","id":"WhatsWrongAndWhy/CVE-2018-18955","title":"WhatsWrongAndWhy/CVE-2018-18955","date":"2026-07-21","url":"https://github.com/WhatsWrongAndWhy/CVE-2018-18955"}],"fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.18.20-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.18.20-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.18.20-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-azure","fixed_in":["4.15.0-1035.36~14.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-azure","fixed_in":["4.15.0-1035.36~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-gcp","fixed_in":["4.15.0-1025.26~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","fixed_in":["4.15.0-42.45~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux","fixed_in":["4.15.0-42.45"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws","fixed_in":["4.15.0-1029.30"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","fixed_in":["4.15.0-1035.36"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","fixed_in":["4.15.0-1025.26"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-kvm","fixed_in":["4.15.0-1027.27"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","fixed_in":["4.15.0-1028.33"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-raspi2","fixed_in":["4.15.0-1029.31"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.20-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.20-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.20-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1035.36~14.04.2"}]}],"versions":["4.15.0-1023.24~14.04.1","4.15.0-1030.31~14.04.1","4.15.0-1031.32~14.04.1","4.15.0-1032.33~14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1035.36~16.04.1"}]}],"versions":["4.11.0-1009.9","4.11.0-1011.11","4.11.0-1013.13","4.11.0-1014.14","4.11.0-1015.15","4.11.0-1016.16","4.13.0-1005.7","4.13.0-1006.8","4.13.0-1007.9","4.13.0-1009.12","4.13.0-1011.14","4.13.0-1012.15","4.13.0-1014.17","4.13.0-1016.19","4.13.0-1018.21","4.15.0-1013.13~16.04.2","4.15.0-1014.14~16.04.1","4.15.0-1018.18~16.04.1","4.15.0-1019.19~16.04.1","4.15.0-1021.21~16.04.1","4.15.0-1022.22~16.04.1","4.15.0-1023.24~16.04.1","4.15.0-1025.26~16.04.1","4.15.0-1028.29~16.04.1","4.15.0-1030.31~16.04.1","4.15.0-1031.32~16.04.1","4.15.0-1032.33~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1025.26~16.04.1"}]}],"versions":["4.10.0-1004.4","4.10.0-1006.6","4.10.0-1007.7","4.10.0-1008.8","4.10.0-1009.9","4.13.0-1002.5","4.13.0-1006.9","4.13.0-1007.10","4.13.0-1008.11","4.13.0-1011.15","4.13.0-1012.16","4.13.0-1013.17","4.13.0-1015.19","4.13.0-1017.21","4.13.0-1019.23","4.15.0-1014.14~16.04.1","4.15.0-1015.15~16.04.1","4.15.0-1017.18~16.04.1","4.15.0-1018.19~16.04.2","4.15.0-1019.20~16.04.1","4.15.0-1021.22~16.04.1","4.15.0-1023.24~16.04.1","4.15.0-1024.25~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-42.45~16.04.1"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1","4.10.0-32.36~16.04.1","4.10.0-33.37~16.04.1","4.10.0-35.39~16.04.1","4.10.0-37.41~16.04.1","4.10.0-38.42~16.04.1","4.10.0-40.44~16.04.1","4.10.0-42.46~16.04.1","4.13.0-26.29~16.04.2","4.13.0-31.34~16.04.1","4.13.0-32.35~16.04.1","4.13.0-36.40~16.04.1","4.13.0-37.42~16.04.1","4.13.0-38.43~16.04.1","4.13.0-39.44~16.04.1","4.13.0-41.46~16.04.1","4.13.0-43.48~16.04.1","4.13.0-45.50~16.04.1","4.15.0-24.26~16.04.1","4.15.0-29.31~16.04.1","4.15.0-30.32~16.04.1","4.15.0-32.35~16.04.1","4.15.0-33.36~16.04.1","4.15.0-34.37~16.04.1","4.15.0-36.39~16.04.1","4.15.0-38.41~16.04.1","4.15.0-39.42~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-42.45"}]}],"versions":["4.13.0-16.19","4.13.0-17.20","4.13.0-25.29","4.13.0-32.35","4.15.0-10.11","4.15.0-12.13","4.15.0-13.14","4.15.0-15.16","4.15.0-19.20","4.15.0-20.21","4.15.0-22.24","4.15.0-23.25","4.15.0-24.26","4.15.0-29.31","4.15.0-30.32","4.15.0-32.35","4.15.0-33.36","4.15.0-34.37","4.15.0-36.39","4.15.0-38.41","4.15.0-39.42"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1029.30"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1007.7","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25","4.15.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1035.36"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1025.26"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1027.27"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1012.12","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25","4.15.0-1026.26"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1028.33"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1029.31"}]}],"versions":["4.13.0-1005.5","4.13.0-1006.6","4.13.0-1008.8","4.15.0-1006.7","4.15.0-1009.10","4.15.0-1010.11","4.15.0-1011.12","4.15.0-1012.13","4.15.0-1013.14","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1020.22","4.15.0-1021.23","4.15.0-1022.24","4.15.0-1024.26","4.15.0-1026.28","4.15.0-1027.29","4.15.0-1028.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1029.30"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1007.7","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25","4.15.0-1027.27"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-42.45"}]}],"versions":["4.13.0-16.19","4.13.0-17.20","4.13.0-25.29","4.13.0-32.35","4.15.0-10.11","4.15.0-12.13","4.15.0-13.14","4.15.0-15.16","4.15.0-19.20","4.15.0-20.21","4.15.0-22.24","4.15.0-23.25","4.15.0-24.26","4.15.0-29.31","4.15.0-30.32","4.15.0-32.35","4.15.0-33.36","4.15.0-34.37","4.15.0-36.39","4.15.0-38.41","4.15.0-39.42"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1025.26"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1027.27"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1012.12","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25","4.15.0-1026.26"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1029.31"}]}],"versions":["4.13.0-1005.5","4.13.0-1006.6","4.13.0-1008.8","4.15.0-1006.7","4.15.0-1009.10","4.15.0-1010.11","4.15.0-1011.12","4.15.0-1012.13","4.15.0-1013.14","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1020.22","4.15.0-1021.23","4.15.0-1022.24","4.15.0-1024.26","4.15.0-1026.28","4.15.0-1027.29","4.15.0-1028.30"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1025.26~16.04.1"}]}],"versions":["4.10.0-1004.4","4.10.0-1006.6","4.10.0-1007.7","4.10.0-1008.8","4.10.0-1009.9","4.13.0-1002.5","4.13.0-1006.9","4.13.0-1007.10","4.13.0-1008.11","4.13.0-1011.15","4.13.0-1012.16","4.13.0-1013.17","4.13.0-1015.19","4.13.0-1017.21","4.13.0-1019.23","4.15.0-1014.14~16.04.1","4.15.0-1015.15~16.04.1","4.15.0-1017.18~16.04.1","4.15.0-1018.19~16.04.2","4.15.0-1019.20~16.04.1","4.15.0-1021.22~16.04.1","4.15.0-1023.24~16.04.1","4.15.0-1024.25~16.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-42.45~16.04.1"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1","4.10.0-32.36~16.04.1","4.10.0-33.37~16.04.1","4.10.0-35.39~16.04.1","4.10.0-37.41~16.04.1","4.10.0-38.42~16.04.1","4.10.0-40.44~16.04.1","4.10.0-42.46~16.04.1","4.13.0-26.29~16.04.2","4.13.0-31.34~16.04.1","4.13.0-32.35~16.04.1","4.13.0-36.40~16.04.1","4.13.0-37.42~16.04.1","4.13.0-38.43~16.04.1","4.13.0-39.44~16.04.1","4.13.0-41.46~16.04.1","4.13.0-43.48~16.04.1","4.13.0-45.50~16.04.1","4.15.0-24.26~16.04.1","4.15.0-29.31~16.04.1","4.15.0-30.32~16.04.1","4.15.0-32.35~16.04.1","4.15.0-33.36~16.04.1","4.15.0-34.37~16.04.1","4.15.0-36.39~16.04.1","4.15.0-38.41~16.04.1","4.15.0-39.42~16.04.1"],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://github.com/torvalds/linux/commit/d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.19","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://usn.ubuntu.com/3836-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3835-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=1712","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://usn.ubuntu.com/3833-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3832-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/45915/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.2","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://www.exploit-db.com/exploits/45886/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Patch","Third Party Advisory","VDB Entry","fix"]},{"url":"https://usn.ubuntu.com/3836-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/105941","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://support.f5.com/csp/article/K39103040","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190416-0003/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18955"},{"url":"https://github.com/advisories/GHSA-c6xj-3c77-g5rg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-18955","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-18955","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3832-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3833-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3836-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3835-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3836-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6559","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-18955","description":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.","status":"published","published":"2018-11-16T20:00:00Z","modified":"2024-08-05T11:23:08.917Z","updated_at":"2026-11-02T14:35:11.799349Z"}],"euvd":[{"id":"EUVD-2018-10659","description":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.","status":"published","published":"2018-11-16T20:00:00Z","modified":"2024-08-05T11:23:08Z","updated_at":"2026-11-03T02:39:34.768254Z"}],"ghsa":[{"id":"GHSA-c6xj-3c77-g5rg","title":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c...","description":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.","status":"published","published":"2022-05-13T01:19:42Z","modified":"2023-02-01T05:05:59Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:50:18.532439Z"}],"nvd":[{"id":"CVE-2018-18955","description":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.","status":"published","published":"2018-11-16T20:29:00.233Z","modified":"2026-06-17T01:48:10.833Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:04:48.987926Z"}],"osv":[{"id":"CVE-2018-18955","description":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.","status":"published","published":"2018-11-16T20:29:00.233Z","modified":"2026-03-15T22:19:43.775464Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-18955","description":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.","status":"published","published":"2018-11-16T20:29:00.233Z","modified":"2026-10-23T18:03:03.139694592Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-18955","description":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.","status":"published","published":"2018-11-16T00:00:00Z","modified":"2026-04-22T11:49:47.52252Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"USN-3833-1","title":"linux-aws vulnerabilities","description":"Jann Horn discovered that the Linux kernel mishandles mapping UID or GID\nranges inside nested user namespaces in some situations. A local attacker\ncould use this to bypass access controls on resources outside the\nnamespace. (CVE-2018-18955)\n\nPhilipp Wendler discovered that the overlayfs implementation in the Linux\nkernel did not properly verify the directory contents permissions from\nwithin a unprivileged user namespace. A local attacker could use this to\nexpose sensitive information (protected file names). (CVE-2018-6559)\n","status":"published","published":"2018-11-30T06:31:39Z","modified":"2026-02-10T04:41:27Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-3836-1","title":"linux, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities","description":"Jann Horn discovered that the Linux kernel mishandles mapping UID or GID\nranges inside nested user namespaces in some situations. A local attacker\ncould use this to bypass access controls on resources outside the\nnamespace. (CVE-2018-18955)\n\nPhilipp Wendler discovered that the overlayfs implementation in the Linux\nkernel did not properly verify the directory contents permissions from\nwithin a unprivileged user namespace. A local attacker could use this to\nexpose sensitive information (protected file names). (CVE-2018-6559)\n","status":"published","published":"2018-12-03T19:40:09Z","modified":"2026-04-22T09:52:58.692098Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-3836-2","title":"linux-hwe, linux-gcp vulnerabilities","description":"USN-3836-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu\n16.04 LTS.\n\nJann Horn discovered that the Linux kernel mishandles mapping UID or GID\nranges inside nested user namespaces in some situations. A local attacker\ncould use this to bypass access controls on resources outside the\nnamespace. (CVE-2018-18955)\n\nPhilipp Wendler discovered that the overlayfs implementation in the Linux\nkernel did not properly verify the directory contents permissions from\nwithin a unprivileged user namespace. A local attacker could use this to\nexpose sensitive information (protected file names). (CVE-2018-6559)\n","status":"published","published":"2018-12-04T04:49:26Z","modified":"2026-02-10T04:41:27Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}