cnvd - cnvd-2018-24290

cnvd-2018-24290

Vulnerability from cnvd

Title

procps/procps-ng隐藏进程漏洞

Description

procps/procps-ng是一款使用在Linux平台中的用于提供proc文件系统进程信息的实用程序。 procps/procps-ng中存在安全漏洞。攻击者可利用该漏洞隐藏进程。

Severity

中

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://gitlab.com/procps-ng/procps

Reference

https://nvd.nist.gov/vuln/detail/CVE-2018-1121

Impacted products

Name
procps/procps-ng procps/procps-ng <3.3.15

Show details on source website

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-1121",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1121"
    }
  },
  "description": "procps/procps-ng\u662f\u4e00\u6b3e\u4f7f\u7528\u5728Linux\u5e73\u53f0\u4e2d\u7684\u7528\u4e8e\u63d0\u4f9bproc\u6587\u4ef6\u7cfb\u7edf\u8fdb\u7a0b\u4fe1\u606f\u7684\u5b9e\u7528\u7a0b\u5e8f\u3002\n\nprocps/procps-ng\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9690\u85cf\u8fdb\u7a0b\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://gitlab.com/procps-ng/procps",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-24290",
  "openTime": "2018-11-22",
  "products": {
    "product": "procps/procps-ng procps/procps-ng \u003c3.3.15"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-1121",
  "serverity": "\u4e2d",
  "submitTime": "2018-06-19",
  "title": "procps/procps-ng\u9690\u85cf\u8fdb\u7a0b\u6f0f\u6d1e"
}

CVE-2018-1121 (GCVE-0-2018-1121)

Vulnerability from cvelistv5

Published

2018-06-13 20:00

Modified

2024-08-05 03:51

Severity ?

3.9 (Low) - CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

CWE

CWE-367

Summary

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.

References

URL

Tags

	https://www.exploit-db.com/exploits/44806/	exploit, x_refsource_EXPLOIT-DB
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1121	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/104214	vdb-entry, x_refsource_BID
	http://seclists.org/oss-sec/2018/q2/122	mailing-list, x_refsource_MLIST
	https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	[UNKNOWN]	procps-ng, procps	Version: up to procps-ng 3.3.15 and newer

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.742Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "44806",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44806/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1121"
          },
          {
            "name": "104214",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104214"
          },
          {
            "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2018/q2/122"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "procps-ng, procps",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "up to procps-ng 3.3.15 and newer"
            }
          ]
        }
      ],
      "datePublic": "2018-05-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel\u0027s proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng\u0027s utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-30T15:26:18",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "44806",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44806/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1121"
        },
        {
          "name": "104214",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1121",
    "datePublished": "2018-06-13T20:00:00",
    "dateReserved": "2017-12-04T00:00:00",
    "dateUpdated": "2024-08-05T03:51:48.742Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.