CVE-2018-5333

MEDIUM

Linux kernel <4.14.13 - Memory Corruption

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2018-5333. PoCs published by TamiiLambrado, Mohamed Ghannam, Jann Horn, wbowling, bcoles, nstarke, including Metasploit module exploits/linux/local/rds_atomic_free_op_null_pointer_deref_priv_esc.

AI-analyzed exploit summary This PoC demonstrates a NULL pointer dereference vulnerability in the Linux kernel's RDS socket implementation (CVE-2018-5333). It exploits improper handling of ancillary data in the `rds_cmsg_atomic` function, leading to a crash when `rds_atomic_free_op` is called on an uninitialized scatterlist.

Description

In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.

Exploits (3)

github WORKING POC 3 stars
by TamiiLambrado · cpoc
https://github.com/TamiiLambrado/CVE-pocs/tree/master/CVE-2018-5333-rds-nullderef.c

This PoC demonstrates a NULL pointer dereference vulnerability in the Linux kernel's RDS socket implementation (CVE-2018-5333). It exploits improper handling of ancillary data in the `rds_cmsg_atomic` function, leading to a crash when `rds_atomic_free_op` is called on an uninitialized scatterlist.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel (v2.6.36-rc1 to v4.14.13)
No auth needed
Prerequisites: Linux system with RDS socket support enabled · Ability to create RDS sockets
devstral-2 · analyzed Feb 27, 2026 Full analysis →
metasploit WORKING POC GOOD
by Mohamed Ghannam, Jann Horn, wbowling, bcoles, nstarke · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/rds_atomic_free_op_null_pointer_deref_priv_esc.rb

This Metasploit module exploits a NULL pointer dereference in the `rds_atomic_free_op` function in the Linux kernel's RDS module (CVE-2018-5333) to achieve local privilege escalation. It combines this with a MAP_GROWSDOWN mmap_min_addr bypass (CVE-2019-9213) and includes KASLR/SMEP bypasses.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (Ubuntu 16.04 kernels 4.4.0 <= 4.4.0-116-generic and 4.8.0 <= 4.8.0-54-generic)
No auth needed
Prerequisites: RDS kernel module loaded (or not blacklisted) · 64-bit Ubuntu-based system · SMAP disabled
devstral-2 · analyzed Apr 23, 2026 Full analysis →
exploitdb WORKING POC
rubylocallinux
https://www.exploit-db.com/exploits/47957

This Metasploit module exploits a NULL pointer dereference in the `rds_atomic_free_op` function in the Linux kernel's RDS module (CVE-2018-5333) to achieve local privilege escalation. It combines this with a MAP_GROWSDOWN mmap_min_addr bypass (CVE-2019-9213) and includes KASLR/SMEP bypasses.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel 4.4.0-116-generic and 4.8.0-54-generic (Ubuntu 16.04)
No auth needed
Prerequisites: RDS kernel module loaded · 64-bit Ubuntu 16.04 system · SMAP disabled
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (15)

Core 15
Core References
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4187
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3617-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3619-2/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3617-3/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3583-2/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3632-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3583-1/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/102510
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0470
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3617-2/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3619-1/

Scores

CVSS v3 5.5
EPSS 0.0280
EPSS Percentile 86.5%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-476
Status published
Products (7)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 17.10
debian/debian_linux 7.0
debian/debian_linux 8.0
linux/linux_kernel < 4.14.13
Published Jan 11, 2018
Tracked Since Feb 18, 2026