Authorization bypass in Linux kernel - CVE-2018-16597

Vulnerability identifier: #VU28412

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-16597

CWE-ID: CWE-863

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local authenticated user to manipulate data.

An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.

Linux kernel
Slackware Linux
Opensuse
linux-4.4.186/kernel-generic
linux-4.4.186/kernel-huge
linux-4.4.186/kernel-modules
linux-4.4.186/kernel-headers

Install update from vendor's website.

Linux kernel - update to 4.4.214
linux-4.4.186/kernel-generic - update to 4.4.186
linux-4.4.186/kernel-huge - update to 4.4.186
linux-4.4.186/kernel-modules - update to 4.4.186
linux-4.4.186/kernel-headers - update to 4.4.186_smp

• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.214

• Authorization bypass in Linux kernel
• OpenSUSE Linux update for the Linux Kernel
• Slackware Linux update for kernel