Test ID:	1.3.6.1.4.1.25623.1.0.843843
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-3836-1)
Summary:	The remote host is missing an update for the 'linux, linux-gcp, linux-kvm, linux-raspi2' package(s) announced via the USN-3836-1 advisory.
Description:	Summary: The remote host is missing an update for the 'linux, linux-gcp, linux-kvm, linux-raspi2' package(s) announced via the USN-3836-1 advisory. Vulnerability Insight: Jann Horn discovered that the Linux kernel mishandles mapping UID or GID ranges inside nested user namespaces in some situations. A local attacker could use this to bypass access controls on resources outside the namespace. (CVE-2018-18955) Philipp Wendler discovered that the overlayfs implementation in the Linux kernel did not properly verify the directory contents permissions from within a unprivileged user namespace. A local attacker could use this to expose sensitive information (protected file names). (CVE-2018-6559) Affected Software/OS: 'linux, linux-gcp, linux-kvm, linux-raspi2' package(s) on Ubuntu 18.04. Solution: Please install the updated package(s). CVSS Score: 4.4 CVSS Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-18955 BugTraq ID: 105941 http://www.securityfocus.com/bid/105941 https://www.exploit-db.com/exploits/45886/ https://www.exploit-db.com/exploits/45915/ http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd https://bugs.chromium.org/p/project-zero/issues/detail?id=1712 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.19 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.2 https://github.com/torvalds/linux/commit/d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd https://usn.ubuntu.com/3832-1/ https://usn.ubuntu.com/3833-1/ https://usn.ubuntu.com/3835-1/ https://usn.ubuntu.com/3836-1/ https://usn.ubuntu.com/3836-2/ Common Vulnerability Exposure (CVE) ID: CVE-2018-6559 BugTraq ID: 105752 http://www.securityfocus.com/bid/105752
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.