CVE-2018-11218: debian debian_linux Out-of-bounds Write
Vulnerability summary
CVE-2018-11218 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 59.01% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 8 · Related 2Timeline
- 17-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
59.01%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 59.01% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundRedis
Maturity: poc
Exploit Reference (antirez.com)
Maturity: unknown
Redis Replication Code Execution
exploit/linux/redis/redis_replication_cmd_exec
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Debian2 products
- redis< 5:4.0.10-1
- debian_linuxEOL9.0
Alpine1 product
- redis≥ 4.0, < 3.2.12-r0 | ≥ 4.0, < 4.0.10-r0
Oracle1 product
- communications_operations_monitor3.4 | 4.0
Redhat1 product
- openstack10 | 13
Redislabs1 product
- redis< 3.2.12 | ≥ 4.0, < 4.0.10 | 5.0:rc1
Ubuntu1 product
- redis< 2:2.8.4-2ubuntu0.2 | < 2:3.0.6-1ubuntu0.2 | < 5:4.0.9-1ubuntu0.1
6 vendors · 7 products
References
17 links
- github.com/antirez/redis/commit/5ccb6f7a791bf3490357b00a898885759d98bab0X Refsource MISCPatchThird Party AdvisoryREPORT
- github.com/antirez/redis/commit/52a00201fca331217c3b4b8b634f6a0f57d6b7d3X Refsource MISCExploitPatchThird Party AdvisoryREPORT
- raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTESX Refsource MISCThird Party AdvisoryREPORT
- raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTESX Refsource MISCThird Party AdvisoryREPORT
Show all 17 references
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party Advisory