Privilege escalation in Linux kernel - CVE-2018-18955

Vulnerability details

The vulnerability allows a local attacker to gain elevated privileges on a targeted system.

The weakness exists due to the map_write() function, as defined in the kernel/user_namespace.c source code file, improperly handles nested user namespaces that have more than five user identifier (UID) or group identifier (GID) ranges. A local attacker with CAP_SYS_ADMIN capabilities in a targeted user namespace can access the system and execute an application that submits malicious input to bypass access controls outside the user namespace and gain elevated privileges on the system.

Affected software

How to mitigate CVE-2018-18955

Links to Public Exploits and PoC-codes

• Exploit #7875 - CVE-2018-18955 (? Linux local root exploit for CVE-2018-18955) (May 23, 2022)
• Exploit #6095 - Linux - Nested User Namespace idmap Limit Local Privilege Escalation (Metasploit) (June 17, 2021)
• Exploit #6098 - Linux - Broken uid/gid Mapping for Nested User Namespaces (June 17, 2021)
• Exploit #6062 - Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method) (June 17, 2021)
• Exploit #6063 - Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method) (June 17, 2021)
• Exploit #6064 - Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method) (June 17, 2021)
• Exploit #6065 - Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method) (June 17, 2021)

External References

• https://github.com/torvalds/linux/commit/d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd
• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.2
• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20

Related Security Bulletins

• Privilege escalation in Linux Kernel