CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 4.4
CWE Name:  Improper Input Validation
Summary: in the linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 uid or gid ranges. a user who has cap_sys_admin in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. this occurs because an id transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-11-16
Last Modified Date: 2019-04-16