PT-2018-2302 · Linux+2 · Linux Kernel+2

Jann Horn · Published 2018-11-07 · Updated 2025-09-29 · CVE-2018-18955

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.15.x through 4.19.x before 4.19.2

Description The issue is related to the map write() function in kernel/user namespace.c, which mishandles nested user namespaces with more than 5 UID or GID ranges. This allows a user with CAP SYS ADMIN in an affected user namespace to bypass access controls on resources outside the namespace. The problem occurs due to improper ID transformation from the kernel to the namespaced direction. A potential exploit could allow an attacker to access sensitive data, such as reading /etc/shadow.

Recommendations For Linux kernel versions 4.15.x through 4.19.x before 4.19.2, update to version 4.19.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of CAP SYS ADMIN in user namespaces to minimize the risk of exploitation. Additionally, restrict access to sensitive resources, such as /etc/shadow, to prevent unauthorized access.

Exploit

Fix

Incorrect Authorization

RCE

Weakness Enumeration

CWE-863

CWE-20

Related Identifiers

ALSA-2025_16880

ALT-PU-2018-2699

ALT-PU-2018-2729

BDU:2019-00432

CVE-2018-18955

USN-3832-1

USN-3833-1

USN-3835-1

USN-3836-1

USN-3836-2

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 49

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/nested_namespace_idmap_limit_priv_esc.rb · Exploit
• 🔥 https://github.com/scheatkode/CVE-2018-18955 · Exploit
• 🔥 https://exploit-db.com/exploits/47167 · Exploit
• 🔥 https://exploit-db.com/exploits/45915 · Exploit
• 🔥 https://exploit-db.com/exploits/47164 · Exploit
• 🔥 https://exploit-db.com/exploits/47166 · Exploit
• 🔥 https://exploit-db.com/exploits/45886 · Exploit
• 🔥 https://exploit-db.com/exploits/47165 · Exploit
• https://github.com/torvalds/linux/commit/d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.2 · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.19 · Vendor Advisory
• https://usn.ubuntu.com/3835-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3832-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3833-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00432 · Security Note