CVE-2018-1121

🗓️ 13 Jun 2018 20:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 168 Views🌐 WEB

procps-ng, procps vulnerable to process hiding through race condition. Unprivileged attacker can hide process from procps-ng by exploiting race condition in reading /proc/PID entries

Reporter	Title	Published	Views	Family All 34
0day.today	Procps-ng - Multiple Vulnerabilities	30 May 201800:00	–	zdt
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	6 Jan 202321:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security is vulnerable to using components with known vulnerabilities	1 Nov 202218:28	–	ibm
Information Security Automation	Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs	30 Dec 202218:03	–	avleonov
Circl	CVE-2018-1121	19 Mar 202600:00	–	circl
CNVD	procps/procps-ng hidden process vulnerability	19 Jun 201800:00	–	cnvd
Cvelist	CVE-2018-1121	13 Jun 201820:00	–	cvelist
Debian CVE	CVE-2018-1121	13 Jun 201820:00	–	debiancve
Exploit DB	Procps-ng - Multiple Vulnerabilities	30 May 201800:00	–	exploitdb
EUVD	EUVD-2018-11765	7 Oct 202500:30	–	euvd

NVD

Vulners

Node

procps_project procpsRange≤3.3.15

[
  {
    "product": "procps-ng, procps",
    "vendor": "[UNKNOWN]",
    "versions": [
      {
        "status": "affected",
        "version": "up to procps-ng 3.3.15 and newer"
      }
    ]
  }
]

Source	Link
qualys	www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
securityfocus	www.securityfocus.com/bid/104214
exploit-db	www.exploit-db.com/exploits/44806/
seclists	www.seclists.org/oss-sec/2018/q2/122

Parameter	Position	Path	Description	CWE
PID entries	path	/proc	Race condition in reading /proc directory entries used to enumerate processes (proc_pid_readdir) allowing process hiding/enumeration bypass.	CWE-362, CWE-367
PID	path	/proc/PID/cmdline	FUSE-backed synchronization can block /proc/PID/cmdline and enable race-based hiding/enumeration evasion.	CWE-362, CWE-367
cmdline	path	/proc/PID/cmdline	FUSE-backed synchronization can block /proc/PID/cmdline and enable race-based hiding/enumeration evasion.	CWE-362, CWE-367
PID	path	/proc/PID/stat	Race condition leveraging /proc/PID/stat during process list scanning to hide a process.	CWE-362, CWE-367
stat	path	/proc/PID/stat	Race condition leveraging /proc/PID/stat during process list scanning to hide a process.	CWE-362, CWE-367
/proc PIDs	path	/tmp/fuse/hello	FUSE-based cmdline backdoor used as synchronization tool for race conditions in procfs enumeration.	CWE-362, CWE-367
cmdline synchronization	path	/tmp/fuse/hello	FUSE-based cmdline backdoor used as synchronization tool for race conditions in procfs enumeration.	CWE-362, CWE-367

21 Nov 2024 03:59Current

5.5Medium risk

Vulners AI Score5.5

CVSS 24.3

CVSS 33.9 - 5.9

EPSS0.01988