MEDIUM
kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c
Published Mar 16, 2018
6.7
MEDIUMCVSS 3.1
EPSS 0.45%
Description
A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.
Affected products
-
- Version 4.xStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux Kernel Organization, Inc. | Linux Kernel | n/a |
|
Configuration 1
OR
- < 3.2.102
- ≥ 3.3 · < 3.16.57
- ≥ 3.17 · < 3.18.100
- ≥ 3.19 · < 4.1.51
- ≥ 4.2 · < 4.4.122
- ≥ 4.5 · < 4.9.88
- ≥ 4.10 · < 4.14.27
- ≥ 4.15 · < 4.15.10
Configuration 2
OR
- 12.04
- 14.04
- 16.04
- 17.10
Configuration 3
OR
- 7.0
- 8.0
- 9.0
Configuration 4
OR
- 4.0
- 7.0
- 7.0
- 7.6
- 7.5
- 7.6
- 7.6
- 7.0
No data.
Red Hat Enterprise Linux 7
kernel-0:3.10.0-862.2.3.el7
Fixed · RHSA-2018:1318
Red Hat Enterprise Linux 7
kernel-alt-0:4.14.0-115.el7a
Fixed · RHSA-2018:2948
Red Hat Enterprise Linux 7
kernel-rt-0:3.10.0-862.2.3.rt56.806.el7
Fixed · RHSA-2018:1355
Red Hat Enterprise Linux 7.3 Advanced Update Support
kernel-0:3.10.0-514.71.1.el7
Fixed · RHSA-2019:4159
Red Hat Enterprise Linux 7.3 Telco Extended Update Support
kernel-0:3.10.0-514.71.1.el7
Fixed · RHSA-2019:4159
Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions
kernel-0:3.10.0-514.71.1.el7
Fixed · RHSA-2019:4159
Red Hat Enterprise Linux 7.4 Extended Update Support
kernel-0:3.10.0-693.47.2.el7
Fixed · RHSA-2019:1170
Red Hat Enterprise MRG 2
kernel-rt-1:3.10.0-693.47.2.rt56.641.el6rt
Fixed · RHSA-2019:1190
Red Hat Enterprise Linux 5
kernel
Not affected
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 8
kernel
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | kernel-0:3.10.0-862.2.3.el7 | Fixed | RHSA-2018:1318 |
| Red Hat Enterprise Linux 7 | kernel-alt-0:4.14.0-115.el7a | Fixed | RHSA-2018:2948 |
| Red Hat Enterprise Linux 7 | kernel-rt-0:3.10.0-862.2.3.rt56.806.el7 | Fixed | RHSA-2018:1355 |
| Red Hat Enterprise Linux 7.3 Advanced Update Support | kernel-0:3.10.0-514.71.1.el7 | Fixed | RHSA-2019:4159 |
| Red Hat Enterprise Linux 7.3 Telco Extended Update Support | kernel-0:3.10.0-514.71.1.el7 | Fixed | RHSA-2019:4159 |
| Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions | kernel-0:3.10.0-514.71.1.el7 | Fixed | RHSA-2019:4159 |
| Red Hat Enterprise Linux 7.4 Extended Update Support | kernel-0:3.10.0-693.47.2.el7 | Fixed | RHSA-2019:1170 |
| Red Hat Enterprise MRG 2 | kernel-rt-1:3.10.0-693.47.2.rt56.641.el6rt | Fixed | RHSA-2019:1190 |
| Red Hat Enterprise Linux 5 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
6.7 MEDIUM NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
8.1 HIGH Red Hat
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector Local
Attack Complexity High
Privileges Required None
User Interaction None
Scope Changed
Confidentiality Impact High
Integrity Impact High
Availability Impact High
7.2 HIGH NVD
AV:L/AC:L/Au:N/C:C/I:C/A:C
Access Vector Local
Access Complexity Low
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
0.45% 0.00448
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.00448
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (15 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.45% (0.00448) | 36.59th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.45% (0.00451) | 35.59th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.08% (0.00080) | 21.18th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.07% (0.00065) | 30.60th | v3 (v2023.03.01) |
| Jun 20, 2024 | 0.07% (0.00065) | 28.64th | v3 (v2023.03.01) |
| Mar 10, 2023 | 0.07% (0.00065) | 26.61th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.05% (0.00047) | 14.16th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.79% (0.01791) | 77.00th | v2 (v2022.01.01) |
| Feb 23, 2023 | 1.79% (0.01791) | 76.95th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.79% (0.01791) | 74.90th | v2 (v2022.01.01) |
| Feb 4, 2022 | 1.79% (0.01791) | 54.19th | v2 (v2022.01.01) |
| Feb 3, 2022 | 4.66% (0.04661) | 76.86th | v1 |
| Jan 6, 2022 | 4.66% (0.04661) | 76.64th | v1 |
| Sep 1, 2021 | 4.66% (0.04661) | 86.29th | v1 |
| Apr 14, 2021 | 4.66% (0.04661) | 0.00th | v1 |
Weaknesses (2)
References (25)
- http://www.securityfocus.com/bid/103459 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:1318 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1355 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2948 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1170 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1190 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4159 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2018-1068 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1552048 x_refsource_CONFIRMIssue TrackingThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b71812168571fa55e44cdd0254471331b9c4c4c6 x_refsource_CONFIRMPatchVendor Advisory
- https://github.com/torvalds/linux/commit/b71812168571fa55e44cdd0254471331b9c4c4c6 x_refsource_CONFIRMPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://marc.info/?l=linux-netdev&m=152023808817590&w=2 mailing-listx_refsource_MLISTThird Party Advisory
- https://marc.info/?l=linux-netdev&m=152025888924151&w=2 mailing-listx_refsource_MLISTPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-1068
- https://usn.ubuntu.com/3654-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/3654-2/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/3656-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/3674-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/3674-2/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/3677-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/3677-2/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-1068
- https://www.debian.org/security/2018/dsa-4187 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- https://www.debian.org/security/2018/dsa-4188 vendor-advisoryx_refsource_DEBIANThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/103459 | vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry | |
| https://access.redhat.com/errata/RHSA-2018:1318 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2018:1355 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2018:2948 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:1170 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:1190 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:4159 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/security/cve/CVE-2018-1068 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1552048 | x_refsource_CONFIRMIssue TrackingThird Party Advisory | |
| https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b71812168571fa55e44cdd0254471331b9c4c4c6 | x_refsource_CONFIRMPatchVendor Advisory | |
| https://github.com/torvalds/linux/commit/b71812168571fa55e44cdd0254471331b9c4c4c6 | x_refsource_CONFIRMPatchThird Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html | mailing-listx_refsource_MLISTMailing ListThird Party Advisory | |
| https://marc.info/?l=linux-netdev&m=152023808817590&w=2 | mailing-listx_refsource_MLISTThird Party Advisory | |
| https://marc.info/?l=linux-netdev&m=152025888924151&w=2 | mailing-listx_refsource_MLISTPatchThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2018-1068 | ||
| https://usn.ubuntu.com/3654-1/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://usn.ubuntu.com/3654-2/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://usn.ubuntu.com/3656-1/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://usn.ubuntu.com/3674-1/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://usn.ubuntu.com/3674-2/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://usn.ubuntu.com/3677-1/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://usn.ubuntu.com/3677-2/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2018-1068 | ||
| https://www.debian.org/security/2018/dsa-4187 | vendor-advisoryx_refsource_DEBIANThird Party Advisory | |
| https://www.debian.org/security/2018/dsa-4188 | vendor-advisoryx_refsource_DEBIANThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Mar 16, 2018
Updated Sep 16, 2024
Reserved Dec 4, 2017
Link CVE-2018-1068
CISA Vulnrichment
Updated n/a