WaratekVRT Sign in

CVE-2018-17182

Affected software2 products, listed below
Severity7.8 High CVSS 3.1 2 scores
WeaknessUse after free (CWE-416)
Published19 Sep 2018
Updated17 Jun 2026

Description

An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 4 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC; first seen 2018-09-26.
  • EPSS 3.2% chance in 30 days

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Linux 内核VMA-UAF 提权漏洞（CVE-2018-17182）,0day 130 2018-09-29
GitHub PoC likekabin/vmacache_CVE-2018-17182 1 2018-10-01
Exploit-DB Linux Kernel - VMA Use-After-Free via Buggy vmacache_flush_all() Fastpath Local Privilege Escalation 2018-09-26
Exploit-DB Linux Kernel - VMA Use-After-Free via Buggy vmacache_flush_all() Fastpath Local Privilege Escalation 2018-09-26

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.8 HIGH v3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.2 none AV:L/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Products and versions

5 products, 13 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 14.04 · 16.04 · 18.04
nvd debian debian linux generic 8.0 · 9.0
nvd linux linux kernel generic ≥ 3.16 and ＜ 3.16.58 · ≥ 3.17 and ＜ 3.18.123 · ≥ 3.19 and ＜ 4.4.157 · ≥ 4.5 and ＜ 4.9.128 · ≥ 4.10 and ＜ 4.14.71 · ≥ 4.15 and ＜ 4.18.9
nvd netapp active iq performance analytics services generic any version
nvd netapp element software generic any version

References

URLTags
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7a9cdebdcc17e426fb5287e4a82db1dfe86339b2 Patch, Third Party Advisory
http://www.securityfocus.com/bid/105417 Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/106503 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041748 Patch, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:3656 Third Party Advisory
https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2 Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html Third Party Advisory
https://security.netapp.com/advisory/ntap-20190204-0001/ Patch, Third Party Advisory
https://usn.ubuntu.com/3776-1/ Third Party Advisory
https://usn.ubuntu.com/3776-2/ Third Party Advisory

Timeline
Published2018-09-19By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.