LiveActive security incident?Get immediate response
CVE Record

CVE-2018-1000199: The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() tha...

The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel 3.18 flaw in hardware breakpoint handling. A local user who can run code and use ptrace could crash the system and may trigger memory corruption. The public record names a fixing kernel commit and multiple Linux vendor advisories, but does not provide a CVSS score.

Executive priority

Treat this as a practical maintenance risk, not a confirmed internet-wide emergency. Patch older Linux estates and shared hosts promptly because kernel crashes can disrupt service and memory corruption can raise security concern.

Technical view

CVE-2018-1000199 affects modify_user_hw_breakpoint() in Linux kernel 3.18. The issue is described as a dangerous feature vulnerability leading to crash and possibly memory corruption. Exploitation requires local code execution and ptrace capability. The CVE record identifies commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f as the apparent fix.

Likely exposure

Exposure is most likely on systems running affected Linux 3.18-derived kernels or vendor kernels covered by the cited 2018 advisories. Internet-facing exposure is not indicated; the described path requires local access and ptrace ability.

Exploitation context

The bundle does not show KEV listing or active exploitation evidence. The stated exploitation condition is local code execution with ptrace access, which limits reach but matters on shared hosts, developer machines, containers, and multi-user Linux environments.

Researcher notes

Public details are sparse. The CVE description names modify_user_hw_breakpoint(), local ptrace-based reachability, crash, possible memory corruption, and an apparent fixing commit. Do not assume privilege escalation or active exploitation without additional vendor or threat-intelligence evidence.

Mitigation direction

  • Check vendor advisories for the exact package and kernel versions in use.
  • Update affected Linux kernel packages through the operating system vendor.
  • Prioritize shared, multi-user, and container-host systems running older kernels.
  • If immediate patching is blocked, restrict unnecessary local shell and ptrace access.

Validation and detection

  • Inventory hosts for Linux kernel 3.18 or vendor backports tied to this CVE.
  • Confirm installed kernel packages include the relevant vendor security update.
  • Review whether untrusted users or workloads can execute local code.
  • Check ptrace restrictions and local debugging permissions on exposed systems.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-1000199 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
14Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.