{"schemaVersion":3,"id":"USN-3836-2","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"linux-hwe, linux-gcp vulnerabilities\n\nUSN-3836-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu\n16.04 LTS.\n\nJann Horn discovered that the Linux kernel mishandles mapping UID or GID\nranges inside nested user namespaces in some situations. A local attacker\ncould use this to bypass access controls on resources outside the\nnamespace. (CVE-2018-18955)\n\nPhilipp Wendler discovered that the overlayfs implementation in the Linux\nkernel did not properly verify the directory contents permissions from\nwithin a unprivileged user namespace. A local attacker could use this to\nexpose sensitive information (protected file names). (CVE-2018-6559)","dates":{"published":"2018-12-04T04:49:26.000Z","modified":"2026-02-10T04:41:27.000Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"linux-gcp","name":"linux-gcp","label":"linux-gcp","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/linux-gcp","purlType":"deb","versions":[{"text":"< 4.15.0-1025.26~16.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.15.0-1025.26~16.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"linux-hwe","name":"linux-hwe","label":"linux-hwe","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/linux-hwe","purlType":"deb","versions":[{"text":"< 4.15.0-42.45~16.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.15.0-42.45~16.04.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-3836-2","label":"ubuntu.com/security/notices/USN-3836-2","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-6559","label":"ubuntu.com/security/CVE-2018-6559","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-18955","label":"ubuntu.com/security/CVE-2018-18955","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2018-18955","CVE-2018-6559"],"downstream":[],"duplicates":[],"related":["CVE-2018-18955","CVE-2018-6559"]},"timeline":[{"kind":"published","date":"2018-12-04T04:49:26.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-10T04:41:27.000Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T13:09:36.191Z","stale":false,"partial":false}}