CVE-2018-16597

Published: Sep 21, 2018Modified: Nov 21, 2024

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.

Affected (4)

Products: Linux: Linux Kernel · Netapp: Active Iq Performance Analytics Services, Element Software · Opensuse: Leap

Linux

1 product

Linux Kernel

Netapp

2 products

Active Iq Performance Analytics Services

Element Software

Opensuse

1 product

Leap

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 4.8

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Performance Analytics Services	All versions
Netapp Element Software	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.3

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (16)

http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/105394

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugzilla.suse.com/show_bug.cgi?id=1106512

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862

Source: cve@mitre.org

PatchThird Party Advisory

https://seclists.org/bugtraq/2019/Jul/33

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20190204-0001/

Source: cve@mitre.org

PatchThird Party Advisory

https://support.f5.com/csp/article/K22691834

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html