UBUNTU-CVE-2018-16884
A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.
02 / AFFECTED SOFTWARE
Affected packages
58 explicit affected versions
19 explicit affected versions
6 explicit affected versions
191 explicit affected versions
23 explicit affected versions
5 explicit affected versions
28 explicit affected versions
1 explicit affected versions
8 explicit affected versions
12 explicit affected versions
7 explicit affected versions
1 explicit affected versions
26 explicit affected versions
5 explicit affected versions
4 explicit affected versions
22 explicit affected versions
1 explicit affected versions
23 explicit affected versions
66 explicit affected versions
60 explicit affected versions
24 explicit affected versions
26 explicit affected versions
29 explicit affected versions
7 explicit affected versions
88 explicit affected versions
11 explicit affected versions
51 explicit affected versions
34 explicit affected versions
7 explicit affected versions
47 explicit affected versions
6 explicit affected versions
24 explicit affected versions
26 explicit affected versions
21 explicit affected versions
49 explicit affected versions
3 explicit affected versions
6 explicit affected versions
6 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.
05 / REFERENCES
Further evidence
- https://lore.kernel.org/linux-nfs/[email protected]/T/#m6b9e4d7efcc6b3564f9d53c051caf2370ae8e70a
- https://ubuntu.com/security/CVE-2018-16884
- https://ubuntu.com/security/notices/USN-3932-1
- https://ubuntu.com/security/notices/USN-3932-2
- https://ubuntu.com/security/notices/USN-3980-1
- https://ubuntu.com/security/notices/USN-3980-2
- https://ubuntu.com/security/notices/USN-3981-1
- https://ubuntu.com/security/notices/USN-3981-2
- https://www.cve.org/CVERecord?id=CVE-2018-16884