Medium severity · published Sep 21, 2018
CVE-2018-16597
An issue was discovered in the Linux kernel before 4.8
5.5
CVSS
0.5%
EPSS
No
On KEV
Description
An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
before 4.8 · source: NVD
AI
Active IQ Performance Analytics Services · Netapp
All versions, or not specified · source: NVD
ES
Element Software · Netapp
All versions, or not specified · source: NVD
LE
Leap · Opensuse
42.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16597
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16597
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html
packetstormsecurity.com
http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
Third Party Advisory
http://www.securityfocus.com/bid/105394
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1106512
Patch
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862
seclists.org
https://seclists.org/bugtraq/2019/Jul/33
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability