CVE-2018-19788: canonical ubuntu_linux Improper Input Validation
CVSS: 9.0v2.0HighModified
AliasesALPINE-CVE-2018-19788SUSE-SU-2019:0015-1SUSE-SU-2019:0019-1SUSE-SU-2019:0019-2RHSA-2019:2046RHSA-2019:3232UBUNTU-CVE-2018-19788USN-3861-1DEBIAN-CVE-2018-19788DSA-4350-1openSUSE-SU-2019:0010-1
Published 03-12-2018Last modified 29-08-2024
Vulnerability summary
CVE-2018-19788 is a high (CVSS 9.0) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 11.58% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.0/10
010
High · v2.0 (NVD)EPSS score
11.58%
0%100%
Medium · +0.09 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 03-12-2018PublishedVulnerability first disclosed.
- 29-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources5 sources · 7.0–8.8
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated7.0HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
High 9.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
11.58%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
+0.09 pp
From 11.48% on 18-09-2026
18-09-202618-10-2026
EPSS score11.58%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.freedesktop.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Suse19 products
- polkit&distro=SUSE Enterprise Storage 4< 0.113-5.15.1
- polkit&distro=SUSE Linux Enterprise Desktop 12 SP3< 0.113-5.15.1
- polkit&distro=SUSE Linux Enterprise Desktop 12 SP4< 0.113-5.15.1
- polkit&distro=SUSE Linux Enterprise Module for Basesystem 15< 0.114-3.6.1
- polkit&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 0.113-5.15.1
Redhat4 products
- polkit< 0:0.112-22.el7 | < 0:0.112-18.el7_6.2
- polkit-debuginfo< 0:0.112-22.el7 | < 0:0.112-18.el7_6.2
- polkit-devel< 0:0.112-22.el7 | < 0:0.112-18.el7_6.2
- polkit-docs< 0:0.112-22.el7 | < 0:0.112-18.el7_6.2
Debian2 products
- policykit-1< 0.105-23 | < 0.105-18+deb9u1
- debian_linuxEOL8.0 | 9.0
Alpine1 product
- polkit< 0.105-r8 | < 0.105-r9
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 18.10
Opensuse1 product
- polkit&distro=openSUSE Leap 15.0< 0.114-lp150.2.6.1
Polkit_project1 product
- polkit0.115
Ubuntu1 product
- policykit-1< 0.105-4ubuntu3.14.04.5 | < 0.105-14.1ubuntu0.4 | < 0.105-20ubuntu0.18.04.4
8 vendors · 30 products
References
29 links
lists.debian.org/debian-lts-announce/2019/01/msg00021.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 29 references
- lists.opensuse.org/archives/…Advisory