USN-3836-1: linux Ubuntu
Vulnerability summary
USN-3836-1 is a vulnerability in linux Ubuntu with no CVSS score yet.
Advisory lineage
Upstream 2 · Downstream 0 · Related 2Timeline
- 03-12-2018PublishedVulnerability first disclosed.
- 22-04-2026Last modifiedVulnerability information updated.
Description
linux, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities Jann Horn discovered that the Linux kernel mishandles mapping UID or GID ranges inside nested user namespaces in some situations. A local attacker could use this to bypass access controls on resources outside the namespace. (CVE-2018-18955) Philipp Wendler discovered that the overlayfs implementation in the Linux kernel did not properly verify the directory contents permissions from within a unprivileged user namespace. A local attacker could use this to expose sensitive information (protected file names). (CVE-2018-6559)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu4 products
- linux< 4.15.0-42.45
- linux-gcp< 4.15.0-1025.26
- linux-kvm< 4.15.0-1027.27
- linux-raspi2< 4.15.0-1029.31
1 vendor · 4 products