CVE-2018-6559
Summary
| CVE | CVE-2018-6559 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-10-26 17:29:00 UTC |
| Updated | 2019-10-09 23:41:00 UTC |
| Description | The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access via an overlayfs mount inside of a user namespace. |
Risk And Classification
Problem Types: CWE-200
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.10 | All | All | All |
| Operating System | Linux | Linux Kernel | - | All | All | All |
| Operating System | Linux | Linux Kernel | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Linux Kernel CVE-2018-6559 Local Information Disclosure Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| USN-3832-1: Linux kernel (AWS) vulnerabilities | Ubuntu security notices | UBUNTU | usn.ubuntu.com | Third Party Advisory |
| [PATCH 0/1][B] CVE-2018-6559 - Filename information disclosure in overlayfs | CONFIRM | lists.ubuntu.com | Third Party Advisory |
| USN-3835-1: Linux kernel vulnerabilities | Ubuntu security notices | UBUNTU | usn.ubuntu.com | Third Party Advisory |
| CVE-2018-6559 in Ubuntu | CONFIRM | people.canonical.com | Third Party Advisory |
| Bug #1793458 “Overlayfs in user namespace leaks directory conten...” : Bugs : linux package : Ubuntu | CONFIRM | launchpad.net | Exploit, Issue Tracking, Third Party Advisory |
| USN-3836-1: Linux kernel vulnerabilities | Ubuntu security notices | UBUNTU | usn.ubuntu.com | Third Party Advisory |
| USN-3836-2: Linux kernel (HWE) vulnerabilities | Ubuntu security notices | UBUNTU | usn.ubuntu.com | Third Party Advisory |
| USN-3833-1: Linux kernel (AWS) vulnerabilities | Ubuntu security notices | UBUNTU | usn.ubuntu.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Philipp Wendler
There are currently no legacy QID mappings associated with this CVE.