CVE-2018-1120

🗓️ 20 Jun 2018 13:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 354 Views🌐 WEB

A flaw in Linux kernel pre-4.17 allows indefinite blocking via FUSE-backed file mma

Reporter	Title	Published	Views	Family All 299
0day.today	Procps-ng - Multiple Vulnerabilities	30 May 201800:00	–	zdt
IBM Security Bulletins	Security Bulletin: WebSphere Cast Iron and App Connect Professional are affected by vulnerabilities in Pacemaker, ImageMagick, gd-libgd, libxslt, cURL libcurl , Ghostscript.	21 Feb 202204:39	–	ibm
Tenable Nessus	Amazon Linux 2 : kernel (ALAS-2018-1038) (Spectre)	12 Jun 201800:00	–	nessus
Tenable Nessus	Amazon Linux AMI : kernel (ALAS-2018-1038) (Spectre)	12 Jun 201800:00	–	nessus
Tenable Nessus	CentOS 7 : kernel (CESA-2018:3083)	16 Nov 201800:00	–	nessus
Tenable Nessus	Debian DLA-1423-1 : linux-4.9 new package (Spectre)	20 Jul 201800:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.5.1 : kernel (EulerOS-SA-2018-1280)	18 Sep 201800:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2018-1406)	11 Dec 201800:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-1062)	25 Feb 201900:00	–	nessus
Tenable Nessus	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1510)	13 May 201900:00	–	nessus

NVD

Vulners

Node

linux linux_kernelRange<4.17

Node

redhat virtualization_hostMatch4.0

redhat enterprise_linux_desktopMatch7.0

redhat enterprise_linux_serverMatch7.0

redhat enterprise_linux_workstationMatch7.0

Node

debian debian_linuxMatch8.0

Node

canonical ubuntu_linuxMatch16.04lts

canonical ubuntu_linuxMatch18.04lts

[
  {
    "product": "kernel",
    "vendor": "[UNKNOWN]",
    "versions": [
      {
        "status": "affected",
        "version": "kernel 4.17"
      }
    ]
  }
]

Source	Link
access	www.access.redhat.com/errata/RHSA-2018:2948
securityfocus	www.securityfocus.com/bid/104229
git	www.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/
usn	www.usn.ubuntu.com/3752-3/
security	www.security.gentoo.org/glsa/201805-14
usn	www.usn.ubuntu.com/3910-1/
usn	www.usn.ubuntu.com/3752-1/
access	www.access.redhat.com/errata/RHSA-2018:3096
lists	www.lists.debian.org/debian-lts-announce/2018/07/msg00020.html
access	www.access.redhat.com/errata/RHSA-2018:3083

Parameter	Position	Path	Description	CWE
pid	path	/proc/PID/cmdline	FUSE-backed /proc/PID/cmdline denial of service via mmaping a FUSE file onto cmdline	CWE-119, CWE-122
cmdline	path	/proc/PID/cmdline	FUSE-backed /proc/PID/cmdline denial of service via mmaping a FUSE file onto cmdline	CWE-119, CWE-122
pid	path	/proc/PID/environ	FUSE-backed /proc/PID/environ denial of service via mmaping a FUSE file onto environ	CWE-119, CWE-122
environ	path	/proc/PID/environ	FUSE-backed /proc/PID/environ denial of service via mmaping a FUSE file onto environ	CWE-119, CWE-122
pid	path	/proc/PID/cmdline	PS reads /proc/<pid>/cmdline as part of process listing; vulnerability can cause DoS by blocking read() on cmdline	CWE-119, CWE-122
cmdline	path	/proc/PID/cmdline	PS reads /proc/<pid>/cmdline as part of process listing; vulnerability can cause DoS by blocking read() on cmdline	CWE-119, CWE-122
pid	path	/proc/PID/environ	PS reads /proc/<pid>/environ as part of environment listing; potential DoS via blocking reads	CWE-119, CWE-122
environ	path	/proc/PID/environ	PS reads /proc/<pid>/environ as part of environment listing; potential DoS via blocking reads	CWE-119, CWE-122
cmdline	path	/proc/PID/cmdline	Libprocps libprocps/file2strvec handling of cmdline can overflow/denial of service when parsing cmdline	CWE-119, CWE-122

17 Jun 2026 01:50Current

6.3Medium risk

Vulners AI Score6.3

CVSS 23.5

CVSS 32.8 - 5.3

EPSS0.07291