CVE-2018-16359

low-risk

Published 2018-09-02

Google gVisor before 2018-08-23, within the seccomp sandbox, permits access to the renameat system call, which allows attackers to rename files on the host OS.

Do I need to act?

0.12% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.8/10 Medium

NETWORK / HIGH complexity

Affected Products (1)

Gvisor

Affected Vendors

Google

References (4)

Vendor Advisory https://bugs.chromium.org/p/project-zero/issues/detail?id=1632

Third Party Advisory https://github.com/google/gvisor/commit/001a4c2493b13a43d62c7511fb509a959ae4abc2

Vendor Advisory https://bugs.chromium.org/p/project-zero/issues/detail?id=1632

Third Party Advisory https://github.com/google/gvisor/commit/001a4c2493b13a43d62c7511fb509a959ae4abc2

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal