CVE-2018-1122 procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escal...
HighCVSS 7.0
EPSS 1.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/procps(Debian:12) | < 2:3.3.15-1 | 2:3.3.15-1 |
| debian/procps(Debian:13) | < 2:3.3.15-1 | 2:3.3.15-1 |
| debian/procps(Debian:14) | < 2:3.3.15-1 | 2:3.3.15-1 |
| procps-ng project procps-ng | < 3.3.15 | 3.3.15 |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| [UNKNOWN] procps-ng, procps | = procps-ng 3.3.15 | No fix listed |
References
- Debian Security Tracker CVE-2018-1122 vendor-advisory
- bugs.debian.org issue-tracking
- openSUSE-SU-2019:2376 vendor-advisory
- openSUSE-SU-2019:2379 vendor-advisory
- [oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report mailing-list third-party-advisory
- 104214 third-party-advisory vdb-entry
- RHSA-2019:2189 vendor-advisory
- RHSA-2020:0595 vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- [debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update mailing-list third-party-advisory
- GLSA-201805-14 third-party-advisory vendor-advisory
- USN-3658-1 third-party-advisory vendor-advisory
- USN-3658-3 third-party-advisory vendor-advisory
- DSA-4208 third-party-advisory vendor-advisory
- 44806 exploit third-party-advisory vdb-entry
- www.qualys.com exploit third-party-advisory