Vulnerability Description
Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Control vulnerability in NFS server (nfsd) that can result in remote users reading or writing files they should not be able to via NFS. This attack appear to be exploitable via NFS server must export a filesystem with the "rootsquash" options enabled. This vulnerability appears to have been fixed in after commit 1995266727fa.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 4.4.111, <= 4.4.119 |
Related Weaknesses (CWE)
References
- https://git.kernel.org/linus/1995266727fa8143897e89b55f5d3c79aa828420PatchVendor Advisory
- https://git.kernel.org/linus/1995266727fa8143897e89b55f5d3c79aa828420PatchVendor Advisory
FAQ
What is CVE-2018-1000028?
CVE-2018-1000028 is a vulnerability with a CVSS score of 7.4 (HIGH). Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Control vulnerability in NFS server (nfsd) that can result in remote users reading or...
How severe is CVE-2018-1000028?
CVE-2018-1000028 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-1000028?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.