cve/2018/CVE-2018-18955.md

### [CVE-2018-18955](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18955)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.

### POC

#### Reference
- https://www.exploit-db.com/exploits/45886/
- https://www.exploit-db.com/exploits/45886/
- https://www.exploit-db.com/exploits/45915/
- https://www.exploit-db.com/exploits/45915/

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Al1ex/LinuxEelvation
- https://github.com/De4dCr0w/Linux-kernel-EoP-exp
- https://github.com/HaleyWei/POC-available
- https://github.com/JlSakuya/Linux-Privilege-Escalation-Exploits
- https://github.com/Metarget/metarget
- https://github.com/Micr067/linux-kernel-exploits
- https://github.com/QChiLan/linux-exp
- https://github.com/SecWiki/linux-kernel-exploits
- https://github.com/ShehanSanjula/Linux-Kernel-Exploits
- https://github.com/albinjoshy03/linux-kernel-exploits
- https://github.com/alian87/linux-kernel-exploits
- https://github.com/anoaghost/Localroot_Compile
- https://github.com/bcoles/kernel-exploits
- https://github.com/distance-vector/linux-kernel-exploits
- https://github.com/fei9747/LinuxEelvation
- https://github.com/florentvinai/CompteRendu-CTF-Mordor
- https://github.com/iridium-soda/container-escape-exploits
- https://github.com/kumardineshwar/linux-kernel-exploits
- https://github.com/n3t1nv4d3/kernel-exploits
- https://github.com/rakjong/LinuxElevation
- https://github.com/scheatkode/CVE-2018-18955
- https://github.com/siddicky/yotjf
- https://github.com/substing/internal_ctf
- https://github.com/xfinest/linux-kernel-exploits
- https://github.com/yige666/linux-kernel-exploits