CVE-2018-18955

Name	CVE-2018-18955
Description	In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	buster	4.19.249-2	fixed
	buster (security)	4.19.269-1	fixed
	bullseye	5.10.158-2	fixed
	bullseye (security)	5.10.162-1	fixed
	bookworm, sid	6.1.20-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
linux	source	jessie	(not affected)
linux	source	stretch	(not affected)
linux	source	(unstable)	4.18.20-1

Notes

[stretch] - linux <not-affected> (Introduced in 4.15-rc1)
[jessie] - linux <not-affected> (Introduced in 4.15-rc1)
https://git.kernel.org/linus/d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd
Introduced in https://git.kernel.org/linus/6397fac4915a
https://bugs.chromium.org/p/project-zero/issues/detail?id=1712