CVE-2018-1124 procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create...
HighCVSS 7.8
EPSS 1.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/procps(Debian:12) | < 2:3.3.15-1 | 2:3.3.15-1 |
| debian/procps(Debian:13) | < 2:3.3.15-1 | 2:3.3.15-1 |
| debian/procps(Debian:14) | < 2:3.3.15-1 | 2:3.3.15-1 |
| procps-ng project procps-ng | < 3.3.15 | 3.3.15 |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux | = 7.5 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| schneider-electric struxureware data center expert | < 7.6.0 | 7.6.0 |
| openSUSE leap | = 15.0 | No fix listed |
| openSUSE leap | = 15.1 | No fix listed |
| [UNKNOWN] procps-ng | = procps-ng 3.3.15 | No fix listed |
References
- Debian Security Tracker CVE-2018-1124 vendor-advisory
- bugs.debian.org issue-tracking
- openSUSE-SU-2019:2376 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2019:2379 mailing-list third-party-advisory vendor-advisory
- [oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report mailing-list third-party-advisory
- 104214 third-party-advisory vdb-entry
- 1041057 third-party-advisory vdb-entry
- RHSA-2018:1700 third-party-advisory vendor-advisory
- RHSA-2018:1777 third-party-advisory vendor-advisory
- RHSA-2018:1820 third-party-advisory vendor-advisory
- RHSA-2018:2267 third-party-advisory vendor-advisory
- RHSA-2018:2268 third-party-advisory vendor-advisory
- RHSA-2019:1944 third-party-advisory vendor-advisory
- RHSA-2019:2401 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- help.ecostruxureit.com third-party-advisory
- kc.mcafee.com third-party-advisory
- [debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update mailing-list third-party-advisory
- GLSA-201805-14 third-party-advisory vendor-advisory
- USN-3658-1 third-party-advisory vendor-advisory
- USN-3658-2 third-party-advisory vendor-advisory
- DSA-4208 third-party-advisory vendor-advisory
- 44806 exploit third-party-advisory vdb-entry
- www.qualys.com exploit third-party-advisory