// For flags

CVE-2018-1121

Procps-ng - Multiple Vulnerabilities

Severity Score

5.9
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.

procps-ng, procps son vulnerables a una ocultación de procesos mediante una condición de carrera. Debido a que el proc_pid_readdir() del kernel devuelve las entradas PID en orden numérico ascendente, un proceso que ocupe un PID alto puede emplear eventos inotify para determinar cuándo se está escaneando la lista de procesos y hacer un fork/exec para obtener un PID menor, evitando así la enumeración. Un atacante sin privilegios puede ocultar un proceso de las utilidades procps-ng mediante la explotación de una condición de carrera en la lectura de entradas /proc/PID. Esta vulnerabilidad afecta a procps y procps-ng hasta la versión 3.3.15; versiones posteriores también podrían haberse visto afectadas.

Qualys performed an extensive audit of procps-ng. They discovered hundreds of bugs and vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-12-04 CVE Reserved
  • 2018-05-22 CVE Published
  • 2023-11-04 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
  • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Procps Project
Search vendor "Procps Project"
 Procps
Search vendor "Procps Project" for product "Procps"
 <= 3.3.15
Search vendor "Procps Project" for product "Procps" and version " <= 3.3.15"
-
Affected