CVE-2018-18397: canonical ubuntu_linux Incorrect Authorization
Vulnerability summary
CVE-2018-18397 is a medium (CVSS 5.5) Incorrect Authorization vulnerability in canonical ubuntu_linux. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 43.5% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 8Timeline
- 12-12-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.51% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugs.chromium.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat33 products
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.4 | 7.6
- enterprise_linux_server_eus7.4 | 7.5 | 7.6
- enterprise_linux_server_tus7.4 | 7.6
Ubuntu11 products
- linux< 4.15.0-46.49
- linux-aws< 4.15.0-1033.35
- linux-aws-hwe< 4.15.0-1033.35~16.04.1
- linux-azure< 4.15.0-1040.44~14.04.1 | < 4.15.0-1040.44 | < 4.18.0-1013.13~18.04.1
- linux-gcp< 4.15.0-1028.29~16.04.1 | < 4.15.0-1028.29
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Debian1 product
- linux< 4.19.9-1
Linux1 product
- linux_kernel< 4.19.7
5 vendors · 47 products
References
28 links- github.com/torvalds/linux/commit/29ec90660d68bbdd69507c1c8b4e33aa299278b1X Refsource MISCPatchThird Party Advisory
- access.redhat.com/errata/RHSA-2019:0324Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- bugs.chromium.org/p/project-zero/issues/detail?id=1700X Refsource MISCExploitIssue TrackingThird Party Advisory
- access.redhat.com/errata/RHSA-2019:0202Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
