mirror of
https://github.com/0xMarcio/cve.git
synced 2025-06-01 11:10:36 +00:00
44 lines
2.2 KiB
Markdown
44 lines
2.2 KiB
Markdown
|
### [CVE-2018-18955](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18955)
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
### Description
|
||
|
|
|
||
|
|
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.
|
||
|
|
|
||
|
|
### POC
|
||
|
|
|
||
|
|
#### Reference
|
||
|
|
- https://www.exploit-db.com/exploits/45886/
|
||
|
|
- https://www.exploit-db.com/exploits/45915/
|
||
|
|
|
||
|
|
#### Github
|
||
|
|
- https://github.com/ARPSyndicate/cvemon
|
||
|
|
- https://github.com/Al1ex/LinuxEelvation
|
||
|
|
- https://github.com/De4dCr0w/Linux-kernel-EoP-exp
|
||
|
|
- https://github.com/HaleyWei/POC-available
|
||
|
|
- https://github.com/JlSakuya/Linux-Privilege-Escalation-Exploits
|
||
|
|
- https://github.com/Metarget/metarget
|
||
|
|
- https://github.com/Micr067/linux-kernel-exploits
|
||
|
|
- https://github.com/QChiLan/linux-exp
|
||
|
|
- https://github.com/SecWiki/linux-kernel-exploits
|
||
|
|
- https://github.com/ShehanSanjula/Linux-Kernel-Exploits
|
||
|
|
- https://github.com/albinjoshy03/linux-kernel-exploits
|
||
|
|
- https://github.com/alian87/linux-kernel-exploits
|
||
|
|
- https://github.com/anoaghost/Localroot_Compile
|
||
|
|
- https://github.com/bcoles/kernel-exploits
|
||
|
|
- https://github.com/distance-vector/linux-kernel-exploits
|
||
|
|
- https://github.com/fei9747/LinuxEelvation
|
||
|
|
- https://github.com/florentvinai/CompteRendu-CTF-Mordor
|
||
|
|
- https://github.com/iridium-soda/container-escape-exploits
|
||
|
|
- https://github.com/kumardineshwar/linux-kernel-exploits
|
||
|
|
- https://github.com/n3t1nv4d3/kernel-exploits
|
||
|
|
- https://github.com/rakjong/LinuxElevation
|
||
|
|
- https://github.com/scheatkode/CVE-2018-18955
|
||
|
|
- https://github.com/siddicky/yotjf
|
||
|
|
- https://github.com/substing/internal_ctf
|
||
|
|
- https://github.com/xfinest/linux-kernel-exploits
|
||
|
|
- https://github.com/yige666/linux-kernel-exploits
|
||
|
|
|