CVE-2018-18653 json
The Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot enabled, allows privileged local users to bypass intended S…
published 2018-10-26 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-10369
- cvss
- 7.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
The Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot enabled, allows privileged local users to bypass intended Secure Boot restrictions and execute untrusted code by loading arbitrary kernel modules. This occurs because a modified kernel/module.c, in conjunction with certain configuration options, leads to mishandling of the result of signature verification.
Patch / fix
- linux Debian 14, Debian 13, Debian 12 5.4.6-1
debian advisories DEBIAN-CVE-2018-18653
- usn.ubuntu.com/3835-1/ advisory
- usn.ubuntu.com/3832-1/ advisory
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- launchpad.net https://launchpad.net/bugs/1798863 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-347 Improper Verification of Cryptographic Signature
References
-
usn.ubuntu.com
/3835-1/
vendor-advisory, patch
-
usn.ubuntu.com
/3832-1/
vendor-advisory, patch
-
launchpad.net
/bugs/1798863
exploit, issue-tracking, vendor-advisory
Sources
- CVE List CVE-2018-18653
- NVD CVE-2018-18653
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.