{"uuid": "f7763cf2-6644-4213-aa63-7565acfacd2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-18955", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/nested_namespace_idmap_limit_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Jann Horn\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in Linux kernels 4.15.0 to 4.18.18,\\n          and 4.19.0 to 4.19.1, where broken uid/gid mappings between nested user\\n          namespaces and kernel uid/gid mappings allow elevation to root\\n          (CVE-2018-18955).\\n\\n          The target system must have unprivileged user namespaces enabled and\\n          the newuidmap and newgidmap helpers installed (from uidmap package).\\n\\n          This module has been tested successfully on:\\n\\n          Fedora Workstation 28 kernel 4.16.3-301.fc28.x86_64;\\n          Kubuntu 18.04 LTS kernel 4.15.0-20-generic (x86_64);\\n          Linux Mint 19 kernel 4.15.0-20-generic (x86_64);\\n          Ubuntu Linux 18.04.1 LTS kernel 4.15.0-20-generic (x86_64).\", \"disclosure_date\": \"2018-11-15\", \"fullname\": \"exploit/linux/local/nested_namespace_idmap_limit_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"Linux Nested User Namespace idmap Limit Local Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"AKA\": [\"subuid_shell.c\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/nested_namespace_idmap_limit_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"linux/local/nested_namespace_idmap_limit_priv_esc\", \"references\": [\"BID-105941\", \"CVE-2018-18955\", \"EDB-45886\", \"PACKETSTORM-150381\", \"URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1712\", \"URL-https://github.com/bcoles/kernel-exploits/tree/master/CVE-2018-18955\", \"URL-https://lwn.net/Articles/532593/\", \"URL-https://bugs.launchpad.net/bugs/1801924\", \"URL-https://people.canonical.com/~ubuntu-security/cve/CVE-2018-18955\", \"URL-https://security-tracker.debian.org/tracker/CVE-2018-18955\", \"URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd\", \"URL-https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.19\", \"URL-https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.2\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:09.745395Z"}