{"id":"CVE-2018-18955","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-18955","generatedAt":"2026-10-29T02:04:09.860Z","title":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges.","description":"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.","published":"2018-11-16T20:29:00.000Z","lastModified":"2026-06-17T01:48:11.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":7,"severity":"HIGH","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-863"],"affected":["linux/linux kernel","canonical/ubuntu linux"],"epss":{"score":0.07611,"percentile":0.94522,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.17303,"percentile":0.97026},{"date":"2026-09-22","score":0.07611,"percentile":0.9428}]},"kev":{"listed":false},"exploits":{"count":6,"verified":true,"firstPublished":"2018-11-16","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":47167,"kind":"exploit","title":"Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method)","url":"https://www.exploit-db.com/exploits/47167","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/47167.sh","file":"exploits/linux/local/47167.sh","published":"2019-01-04","added":"2019-07-26","updated":"2019-07-26","author":"bcoles","type":"local","platform":"linux","port":null,"verified":false,"codes":["CVE-2018-18955"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/bcoles/kernel-exploits/blob/a2b01a7421b84bb539d2ca845db5e35f4f86d351/CVE-2018-18955/exploit.polkit.sh"},{"edbId":47165,"kind":"exploit","title":"Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method)","url":"https://www.exploit-db.com/exploits/47165","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/47165.sh","file":"exploits/linux/local/47165.sh","published":"2019-01-04","added":"2019-07-26","updated":"2019-07-26","author":"bcoles","type":"local","platform":"linux","port":null,"verified":false,"codes":["CVE-2018-18955"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/bcoles/kernel-exploits/blob/0792c978066a34ce50f7786d6abd0eb8df218a98/CVE-2018-18955/exploit.dbus.sh"},{"edbId":45915,"kind":"exploit","title":"Linux - Nested User Namespace idmap Limit Local Privilege Escalation (Metasploit)","url":"https://www.exploit-db.com/exploits/45915","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/45915.rb","file":"exploits/linux/local/45915.rb","published":"2018-11-29","added":"2018-11-29","updated":"2018-11-29","author":"Metasploit","type":"local","platform":"linux","port":null,"verified":true,"codes":["CVE-2018-18955"],"tags":"Local","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://raw.githubusercontent.com/rapid7/metasploit-framework/66cae6240f3f24d2fc84223c71c1653da4d22152/modules/exploits/linux/local/nested_namespace_idmap_limit_priv_esc.rb"},{"edbId":47166,"kind":"exploit","title":"Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method)","url":"https://www.exploit-db.com/exploits/47166","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/47166.sh","file":"exploits/linux/local/47166.sh","published":"2018-11-21","added":"2019-07-26","updated":"2019-07-26","author":"bcoles","type":"local","platform":"linux","port":null,"verified":false,"codes":["CVE-2018-18955"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/bcoles/kernel-exploits/blob/d56a3f69e76a4c203d57222f25ace10b654631d0/CVE-2018-18955/exploit.ldpreload.sh"},{"edbId":47164,"kind":"exploit","title":"Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method)","url":"https://www.exploit-db.com/exploits/47164","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/47164.sh","file":"exploits/linux/local/47164.sh","published":"2018-11-21","added":"2019-07-26","updated":"2019-07-26","author":"bcoles","type":"local","platform":"linux","port":null,"verified":false,"codes":["CVE-2018-18955"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/bcoles/kernel-exploits/blob/4be5baae0135c9370420a21134f980b21a5ac1ab/CVE-2018-18955/exploit.cron.sh"},{"edbId":45886,"kind":"exploit","title":"Linux - Broken uid/gid Mapping for Nested User Namespaces","url":"https://www.exploit-db.com/exploits/45886","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/45886.txt","file":"exploits/linux/local/45886.txt","published":"2018-11-16","added":"2018-11-16","updated":"2018-11-16","author":"Google Security Research","type":"local","platform":"linux","port":null,"verified":true,"codes":["CVE-2018-18955"],"tags":"Local","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://bugs.chromium.org/p/project-zero/issues/detail?id=1712"}]},"verdict":{"level":"urgent","text":"6 public exploits are published in Exploit-DB (verified) and the impact is high, while EPSS rates exploitation at 7.6%. Anyone can run this; patch or mitigate before the next change window and check exposed instances for signs of use."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-21T00:00:00.000Z","detail":{"to":0.17303,"from":0.07611,"percentile":0.97026},"summary":"EPSS moved from 7.6% to 17.3% probability of exploitation in the next thirty days."}],"references":[{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/105941","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=1712","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.19","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.2","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/torvalds/linux/commit/d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20190416-0003/","source":"cve@mitre.org"},{"url":"https://support.f5.com/csp/article/K39103040","source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3832-1/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3833-1/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3835-1/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3836-1/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3836-2/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/45886/","tags":["Exploit","Patch","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/45915/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/105941","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=1712","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.19","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.2","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/torvalds/linux/commit/d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190416-0003/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.f5.com/csp/article/K39103040","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3832-1/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3833-1/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3835-1/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3836-1/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3836-2/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/45886/","tags":["Exploit","Patch","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/45915/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-18955","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}