PT-2018-9218 · Linux+1 · Linux Kernel+1

Publicado 2018-02-09 · Atualizado 2019-10-03 · CVE-2018-1000028

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Linux kernel versions after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+

Description: The issue is related to an Incorrect Access Control vulnerability in the NFS server (nfsd) that allows remote users to read or write files they should not be able to access via NFS. This can be exploited when the NFS server exports a filesystem with the "rootsquash" options enabled.

Recommendations: For Linux kernel versions 4.15-rc4 and later, 4.14.8 and later, 4.9.76 and later, 4.4.111 and later, update to a version that includes the fix after commit 1995266727fa to resolve the issue.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

ALT-PU-2018-1384

ALT-PU-2018-1401

CVE-2018-1000028

Produtos afetados

Alt Linux

Linux Kernel

Referências · 8

• https://git.kernel.org/linus/1995266727fa8143897e89b55f5d3c79aa828420 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-1000028 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000028 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-1000028 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000028 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-1000028 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000028 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000028 · Aviso do Fabricante