Vulnerability in Canonical Ubuntu Linux
CVE-2018-18653
The Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot enabled, allows privileged local users to bypass intended Secure Boot restrictions and execute untrusted code by loading arbitrary kernel modules. This occurs because a modified kernel/module.c, in conjunction with certain configuration options, leads to mishandling of the result of signature verification.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (21.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 21.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Canonical Ubuntu Linux — versions 18.10
Weakness classification (CWE)
References
- launchpad.net/bugs/1798863 (Exploit, Issue Tracking, Vendor Advisory)
- usn.ubuntu.com/3835-1/ (vendor-advisory, Patch, Vendor Advisory)
- usn.ubuntu.com/3832-1/ (vendor-advisory, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-18653?
- CVE-2018-18653 is a high-severity vulnerability in Canonical Ubuntu Linux, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.8/10. Published 2018-10-26.
- How severe is CVE-2018-18653?
- High severity. CVSS v3 base score is 7.8 out of 10.