vendor:
procps-ng
by:
Qualys Security Advisory
7.8
CVSS
HIGH
FUSE-backed /proc/PID/cmdline, Unprivileged process hiding, Local Privilege Escalation in top (Low Impact), Denial of Service in ps, Local Privilege Escalation in libprocps (High Impact)
119, 200, 787, 20, 119
CWE
Product Name: procps-ng
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: CVE-2018-1120, CVE-2018-1121, CVE-2018-1122, CVE-2018-1123, CVE-2018-1124
CPE: N/A
Metasploit:
https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2018-10844/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2018-10845/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2018-10846/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/redhat_linux-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp2-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp3-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/amazon_linux-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/ubuntu-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/f5-big-ip-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2018-1120/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2018-1121/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2018-0494/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2018-1301/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2018-14526/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/redhat_linux-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp2-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp3-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/f5-big-ip-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/ubuntu-cve-2018-1122/, https://www.rapid7.com/db/vulnerabilities/amazon_linux-cve-2018-10906/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2018-10906/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2018-1123/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp2-cve-2018-1123/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp3-cve-2018-1123/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2018-1123/, https://www.rapid7.com/db/vulnerabilities/ubuntu-cve-2018-1123/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2018-1123/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2018-1123/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2018-1126/, https://www.rapid7.com/db/vulnerabilities/ubuntu-cve-2018-1126/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2018-1124/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2018-1124/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2018-1124/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2018-1124/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2018-1126/, https://www.rapid7.com/db/vulnerabilities/redhat_linux-cve-2018-1124/, https://www.rapid7.com/db/vulnerabilities/redhat_linux-cve-2018-1126/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp2-cve-2018-1124/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp2-cve-2018-1126/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp3-cve-2018-1126/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2018-1124/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2018-1126/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp3-cve-2018-1124/, https://www.rapid7.com/db/vulnerabilities/f5-big-ip-cve-2018-1124/, https://www.rapid7.com/db/vulnerabilities/f5-big-ip-cve-2018-1126/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2018-1124/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2018-1126/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2018-1126/, https://www.rapid7.com/db/?q=CVE-2018-1124&type=&page=2, https://www.rapid7.com/db/?q=CVE-2018-1124&type=&page=2
Other Scripts:
https://www.infosecmatter.com/nessus-plugin-library/?id=109620, https://www.infosecmatter.com/nessus-plugin-library/?id=118990, https://www.infosecmatter.com/nessus-plugin-library/?id=110455, https://www.infosecmatter.com/nessus-plugin-library/?id=110170, https://www.infosecmatter.com/nessus-plugin-library/?id=140745, https://www.infosecmatter.com/nessus-plugin-library/?id=117586, https://www.infosecmatter.com/nessus-plugin-library/?id=120599, https://www.infosecmatter.com/nessus-plugin-library/?id=122609, https://www.infosecmatter.com/nessus-plugin-library/?id=109639, https://www.infosecmatter.com/nessus-plugin-library/?id=109644, https://www.infosecmatter.com/nessus-plugin-library/?id=119504, https://www.infosecmatter.com/nessus-plugin-library/?id=135072, https://www.infosecmatter.com/nessus-plugin-library/?id=136074, https://www.infosecmatter.com/nessus-plugin-library/?id=110323, https://www.infosecmatter.com/nessus-plugin-library/?id=109667, https://www.infosecmatter.com/nessus-plugin-library/?id=109922, https://www.infosecmatter.com/nessus-plugin-library/?id=110159, https://www.infosecmatter.com/nessus-plugin-library/?id=121844, https://www.infosecmatter.com/nessus-plugin-library/?id=127263, https://www.infosecmatter.com/nessus-plugin-library/?_page=86, https://www.infosecmatter.com/nessus-plugin-library/?id=118428, https://www.infosecmatter.com/nessus-plugin-library/?id=122361, https://www.infosecmatter.com/nessus-plugin-library/?id=112035, https://www.infosecmatter.com/nessus-plugin-library/?id=143038, https://www.infosecmatter.com/nessus-plugin-library/?id=130229, https://www.infosecmatter.com/nessus-plugin-library/?id=121926, https://www.infosecmatter.com/nessus-plugin-library/?id=111291, https://www.infosecmatter.com/nessus-plugin-library/?id=107201, https://www.infosecmatter.com/nessus-plugin-library/?id=109376, https://www.infosecmatter.com/nessus-plugin-library/?id=107202, https://www.infosecmatter.com/nessus-plugin-library/?id=110127, https://www.infosecmatter.com/nessus-plugin-library/?id=118428, https://www.infosecmatter.com/nessus-plugin-library/?id=112035, https://www.infosecmatter.com/nessus-plugin-library/?id=122361, https://www.infosecmatter.com/nessus-plugin-library/?id=117487, https://www.infosecmatter.com/nessus-plugin-library/?id=119132, https://www.infosecmatter.com/nessus-plugin-library/?id=119479, https://www.infosecmatter.com/nessus-plugin-library/?id=109814, https://www.infosecmatter.com/nessus-plugin-library/?id=119736, https://www.infosecmatter.com/nessus-plugin-library/?id=120293, https://www.infosecmatter.com/nessus-plugin-library/?id=109526, https://www.infosecmatter.com/nessus-plugin-library/?id=111366, https://www.infosecmatter.com/nessus-plugin-library/?id=110467, https://www.infosecmatter.com/nessus-plugin-library/?id=118428, https://www.infosecmatter.com/nessus-plugin-library/?id=122361, https://www.infosecmatter.com/nessus-plugin-library/?id=110070, https://www.infosecmatter.com/nessus-plugin-library/?id=110296, https://www.infosecmatter.com/nessus-plugin-library/?id=112035, https://www.infosecmatter.com/nessus-plugin-library/?id=108643, https://www.infosecmatter.com/nessus-plugin-library/?id=109027
Platforms Tested: Linux
2018
Qualys Security Advisory – Procps-ng Audit Report
An attacker can block any read() access to /proc/PID/cmdline by mmap()ing a FUSE file (Filesystem in Userspace) onto this process's command-line arguments. An attacker can hide a process from the ps and w utilities by changing the process's name to a string that contains a non-printable character. An attacker can cause top to crash by sending it a SIGWINCH signal while it is in the middle of a read() call. An attacker can cause ps to crash by sending it a SIGWINCH signal while it is in the middle of a read() call. An attacker can cause a stack-based buffer overflow in libprocps by sending a specially crafted /proc/PID/stat file to the ps utility.
Mitigation:
Patches are available at https://www.qualys.com/2018/05/17/procps-ng-audit-report-patches.tar.gz and base64-encoded at the end of this advisory.