CVE-2018-6559

The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access via an overlayfs mount inside of a user namespace.

CVSS v3.0 3.3 LOW
CVSS v2.0 2.1 LOW

3.3^/10

CVSS v3.0 : LOW

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-6559.html	Third Party Advisory
https://lists.ubuntu.com/archives/kernel-team/2018-October/096172.html	Third Party Advisory
https://launchpad.net/bugs/1793458	Exploit Issue Tracking Third Party Advisory
http://www.securityfocus.com/bid/105752	VDB Entry Third Party Advisory
https://usn.ubuntu.com/3833-1/	Third Party Advisory
https://usn.ubuntu.com/3832-1/	Third Party Advisory
https://usn.ubuntu.com/3836-2/	Third Party Advisory
https://usn.ubuntu.com/3836-1/	Third Party Advisory
https://usn.ubuntu.com/3835-1/	Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*

Information

Published : 2018-10-26 10:29

Updated : 2019-10-09 16:41

NVD link : CVE-2018-6559

Mitre link : CVE-2018-6559

JSON object : View

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Advertisement

Products Affected

canonical

ubuntu_linux

linux

linux_kernel

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-6559.html", "name": "https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-6559.html", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://lists.ubuntu.com/archives/kernel-team/2018-October/096172.html", "name": "https://lists.ubuntu.com/archives/kernel-team/2018-October/096172.html", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://launchpad.net/bugs/1793458", "name": "https://launchpad.net/bugs/1793458", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/105752", "name": "105752", "tags": ["VDB Entry", "Third Party Advisory"], "refsource": "BID"}, {"url": "https://usn.ubuntu.com/3833-1/", "name": "USN-3833-1", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/3832-1/", "name": "USN-3832-1", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/3836-2/", "name": "USN-3836-2", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/3836-1/", "name": "USN-3836-1", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/3835-1/", "name": "USN-3835-1", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access via an overlayfs mount inside of a user namespace."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-200"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2018-6559", "ASSIGNER": "security@ubuntu.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "LOW", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}}, "publishedDate": "2018-10-26T17:29Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2019-10-09T23:41Z"}