CVE-2018-16884

Published: 18 December 2018

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.

From the Ubuntu Security Team

Vasily Averin and Evgenii Shatokhin discovered that a use-after-free vulnerability existed in the NFS41+ subsystem when multiple network namespaces are in use. A local attacker in a container could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16884
• https://lore.kernel.org/linux-nfs/1b3282c0-12ce-0e2c-0fa9-63418a3f2a80@virtuozzo.com/T/#m6b9e4d7efcc6b3564f9d53c051caf2370ae8e70a
• https://ubuntu.com/security/notices/USN-3932-1
• https://ubuntu.com/security/notices/USN-3932-2
• https://ubuntu.com/security/notices/USN-3980-1
• https://ubuntu.com/security/notices/USN-3981-1
• https://ubuntu.com/security/notices/USN-3980-2
• https://ubuntu.com/security/notices/USN-3981-2
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16884