Vulnetix
Try Vulnetix Request Demo
CVE-2018-18397 PUBLISHED

The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.

EPSS 0.07% · 20.7th percentile

Risk Scores

EPSS Score
0.07%
20.7th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSlinux-azure4.15.0-1035.36~14.04.2, 4.15.0-1036.38~14.04.2, 4.15.0-1037.39~14.04.2
Ubuntu:16.04:LTSlinux-gcp0, 4.10.0-1004.4, 4.10.0-1006.6
Ubuntu:18.04:LTSlinux-aws4.15.0-1020.20, 4.15.0-1032.34, 4.15.0-1031.33
Ubuntu:18.04:LTSlinux-oracle0, 4.15.0-1007.9, 4.15.0-1008.10
Ubuntu:18.04:LTSlinux-gcp4.15.0-1015.15, 4.15.0-1017.18, 4.15.0-1018.19
Ubuntu:18.04:LTSlinux-raspi24.15.0-1031.33, 0, 4.13.0-1005.5
Ubuntu:18.04:LTSlinux4.13.0-32.35, 4.15.0-45.48, 4.15.0-44.47
Ubuntu:18.04:LTSlinux-gcp-edge4.18.0-1004.5~18.04.1, 4.18.0-1006.7~18.04.1, 4.18.0-1005.6~18.04.1
Ubuntu:16.04:LTSlinux-oracle0, 4.15.0-1007.9~16.04.1, 4.15.0-1008.10~16.04.1
Ubuntu:18.04:LTSlinux-oem4.15.0-1012.15, 4.15.0-1013.16, 4.15.0-1015.18
Ubuntu:16.04:LTSlinux-aws-hwe4.15.0-1032.34~16.04.1, 0, 4.15.0-1030.31~16.04.1
Ubuntu:18.04:LTSlinux-hwe0, 4.18.0-15.16~18.04.1, 4.18.0-14.15~18.04.1
Ubuntu:18.04:LTSlinux-kvm4.15.0-1027.27, 0, 4.15.0-1002.2
Ubuntu:16.04:LTSlinux-hwe4.10.0-28.32~16.04.2, 4.10.0-30.34~16.04.1, 4.10.0-32.36~16.04.1
Ubuntu:16.04:LTSlinux-azure4.15.0-1022.22~16.04.1, 4.15.0-1018.18~16.04.1, 4.15.0-1014.14~16.04.1
Ubuntu:18.04:LTSlinux-azure4.15.0-1025.26, 4.15.0-1023.24, 4.15.0-1022.23

Timeline

References

Open in Interactive Console →