What’s Vulnerable › Vulnerabilities

CVE-2018-8822

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-20 · updated 2026-06-17
• Weakness: CWE-119

Description

Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through 4.16-rc6, could be exploited by malicious NCPFS servers to crash the kernel or execute code.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 17.10
• Debian Linux: 7.0, 8.0, 9.0
• Linux kernel: from 2.6.12 before 3.2.102; from 3.3 before 3.16.57; from 3.17 before 3.18.103; from 3.19 before 4.1.52; from 4.2 before 4.4.125; from 4.5 before 4.9.91 — fixed in 3.16.57, 3.18.103, 3.2.102, 4.1.52, 4.14.31, 4.15.14

How to fix

Upgrade to a fixed version: Linux kernel 3.16.57, 3.18.103, 3.2.102, 4.1.52. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2022/12/27/3
• http://www.securityfocus.com/bid/103476
• https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html
• https://usn.ubuntu.com/3653-1/
• https://usn.ubuntu.com/3653-2/
• https://usn.ubuntu.com/3654-1/
• https://usn.ubuntu.com/3654-2/
• https://usn.ubuntu.com/3655-1/
• https://usn.ubuntu.com/3655-2/
• https://usn.ubuntu.com/3656-1/
• https://usn.ubuntu.com/3657-1/
• https://www.debian.org/security/2018/dsa-4187

Get alerted when CVE-2018-8822 or the next vulnerability affects your stack