Vulnerability record · CVE-2018-1166 · published 21 February 2018

CVE-2018-1166: Joyent smartos use after free vulnerability

JJoyent · Smartos

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the SMBIOC_TREE_RELE ioctl. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-4984.

7.8 CVSS 3.0 High EPSS 0.38% · top 70.5% CWE-416 · Use after freeCWE-20 · Improper input validation

7.8CVSS 3.0 base score, v2 7.2

0.38%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

JSmartos Joyent

References

Link	Tags
https://help.joyent.com/hc/en-us/articles/360000124928	Vendor Advisory
https://zerodayinitiative.com/advisories/ZDI-18-159	Third Party AdvisoryVDB Entry
https://help.joyent.com/hc/en-us/articles/360000124928	Vendor Advisory
https://zerodayinitiative.com/advisories/ZDI-18-159	Third Party AdvisoryVDB Entry

Track CVE-2018-1166 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-27678Illumos classic buffer overflow vulnerabilityAn issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There …EPSS 1.4%26 Oct 2020 8.8CVE-2016-8733Joyent smartos integer overflow vulnerabilityAn exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system …EPSS 0.55%14 Dec 2016 7.8CVE-2016-9031Joyent smartos integer overflow vulnerabilityAn exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system …EPSS 0.49%14 Dec 2016 7.2CVE-2012-0217Freebsd memory buffer overflow vulnerabilityThe x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solari…EPSS 40%12 Jun 2012 7.0CVE-2018-1171Joyent smartos out-of-bounds write vulnerabilityThis vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An …EPSS 0.44%19 Mar 2018 7.0CVE-2018-1165Joyent smartos heap-based buffer overflow vulnerabilityThis vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An …EPSS 0.50%21 Feb 2018 7.0CVE-2016-9035Joyent smartos classic buffer overflow vulnerabilityAn exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system c…EPSS 0.54%14 Dec 2016 7.0CVE-2016-9034Joyent smartos classic buffer overflow vulnerabilityAn exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system c…EPSS 0.53%14 Dec 2016

Source: NIST National Vulnerability Database (record CVE-2018-1166), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.