Medium severity5.5OSV Advisory· Published Dec 12, 2018· Updated Jun 17, 2026
CVE-2018-18397
CVE-2018-18397
Description
The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
39- Range: v2.6.12-rc2, v2.6.12-rc3, v2.6.12-rc4, …
- osv-coords37 versionspkg:rpm/opensuse/kernel-source&distro=openSUSE%20Leap%2015.0pkg:rpm/suse/kernel-azure&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015pkg:rpm/suse/kernel-azure&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/kernel-azure&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2012%20SP4pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP4pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4pkg:rpm/suse/kernel-livepatch-SLE15_Update_8&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4pkg:rpm/suse/kernel-source-azure&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015pkg:rpm/suse/kernel-source-azure&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/kernel-source-azure&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/kernel-syms-azure&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015pkg:rpm/suse/kernel-syms-azure&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/kernel-syms-azure&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/kernel-vanilla&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/kgraft-patch-SLE12-SP4_Update_2&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2012%20SP4
< 4.12.14-lp150.12.45.1+ 36 more
- (no CPE)range: < 4.12.14-lp150.12.45.1
- (no CPE)range: < 4.12.14-5.19.1
- (no CPE)range: < 4.12.14-6.6.2
- (no CPE)range: < 4.12.14-6.6.2
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 1-1.3.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-5.19.1
- (no CPE)range: < 4.12.14-6.6.2
- (no CPE)range: < 4.12.14-6.6.2
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-5.19.1
- (no CPE)range: < 4.12.14-6.6.2
- (no CPE)range: < 4.12.14-6.6.2
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-95.6.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 4.12.14-25.28.1
- (no CPE)range: < 1-6.3.1
Patches
Vulnerability mechanics
References
14- git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/nvdPatchThird Party Advisory
- cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.87nvdPatchVendor Advisory
- cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.7nvdPatchVendor Advisory
- github.com/torvalds/linux/commit/29ec90660d68bbdd69507c1c8b4e33aa299278b1nvdPatchThird Party Advisory
- bugs.chromium.org/p/project-zero/issues/detailnvdExploitIssue TrackingThird Party Advisory
- access.redhat.com/errata/RHBA-2019:0327nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2019:0163nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2019:0202nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2019:0324nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2019:0831nvdThird Party Advisory
- usn.ubuntu.com/3901-1/nvdThird Party Advisory
- usn.ubuntu.com/3901-2/nvdThird Party Advisory
- usn.ubuntu.com/3903-1/nvdThird Party Advisory
- usn.ubuntu.com/3903-2/nvdThird Party Advisory
News mentions
0No linked articles in our index yet.