CVE-2018-5332

HIGH

Linux kernel <3.2 - Memory Corruption

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-5332. PoCs published by TamiiLambrado.

AI-analyzed exploit summary This PoC exploits an out-of-bounds write vulnerability in the Linux RDS socket implementation (CVE-2018-5332) by manipulating ancillary data to trigger an integer underflow in sg_init_table, leading to memory corruption.

Description

In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).

Exploits (1)

github WORKING POC 3 stars
by TamiiLambrado · cpoc
https://github.com/TamiiLambrado/CVE-pocs/tree/master/CVE-2018-5332-rds-oobw.c

This PoC exploits an out-of-bounds write vulnerability in the Linux RDS socket implementation (CVE-2018-5332) by manipulating ancillary data to trigger an integer underflow in sg_init_table, leading to memory corruption.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel (v2.6.29-rc6 to v4.14.12)
No auth needed
Prerequisites: Linux system with RDS socket support · ability to create RDS sockets
devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (15)

Core 15
Core References
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4187
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3617-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3619-2/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3617-3/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3632-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3620-2/
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/102507
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0470
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3617-2/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3620-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3619-1/

Scores

CVSS v3 7.8
EPSS 0.0043
EPSS Percentile 33.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (7)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 17.10
debian/debian_linux 7.0
debian/debian_linux 8.0
linux/linux_kernel < 3.2.99
Published Jan 11, 2018
Tracked Since Feb 18, 2026