CVE-2018-18445

HIGH

Linux Kernel 4.14.9-4.18.12 - Out-of-bounds Read in BPF Verifier

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-18445. PoCs published by fabrizioperna.

AI-analyzed exploit summary This repository contains a functional PoC for CVE-2018-18445, a vulnerability in the eBPF verifier. The PoC includes detailed explanations of BPF instruction macros and a C program that exploits the flaw.

Description

In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts.

Exploits (1)

github WORKING POC
by fabrizioperna · cpoc
https://github.com/fabrizioperna/ebpf-verifier-cve-pocs/tree/main/CVE-2018-18445

This repository contains a functional PoC for CVE-2018-18445, a vulnerability in the eBPF verifier. The PoC includes detailed explanations of BPF instruction macros and a C program that exploits the flaw.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel eBPF verifier
No auth needed
Prerequisites: Ubuntu MATE 18.04.1 environment · gcc compiler
devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (13)

Core 13
Core References
Patch, Release Notes, Third Party Advisory x_refsource_misc
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.13
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3847-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3835-1/
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:0512
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3847-2/
Patch, Release Notes, Third Party Advisory x_refsource_misc
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.75
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3832-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3847-3/
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:0514
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugs.chromium.org/p/project-zero/issues/detail?id=1686
Third Party Advisory x_refsource_confirm
https://support.f5.com/csp/article/K38456756

Scores

CVSS v3 7.8
EPSS 0.0004
EPSS Percentile 14.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-125
Status published
Products (12)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 18.10
linux/linux_kernel 4.14.9 - 4.14.75
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_server 7.0
redhat/enterprise_linux_server 7.6
redhat/enterprise_linux_server_aus 7.6
redhat/enterprise_linux_server_eus 7.6
... and 2 more
Published Oct 17, 2018
Tracked Since Feb 18, 2026