CVE-2018-1000140 Memory corruption in n/a

Critical 9.8 Published 23 Mar 2018 Updated 5 Aug 2024

A remote attacker can execute arbitrary code by sending a specially crafted x509 certificate to rsyslog via the librelp library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-1000140?

CVE-2018-1000140 is a critical memory corruption vulnerability in Canonical Ubuntu Linux, published on 23 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.

Weakness: CWE-787

Which versions are affected by CVE-2018-1000140?

It affects 9 products.

Linux distribution packages (40)

`librelp` Red Hat:enterprise_linux:6::client	All versions	`0:1.2.7-3.el6_9.1`
`librelp-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:1.2.7-3.el6_9.1`
`librelp-devel` Red Hat:enterprise_linux:6::client	All versions	`0:1.2.7-3.el6_9.1`
`librelp` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.2.7-3.el6_9.1`
`librelp-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.2.7-3.el6_9.1`
`librelp-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.2.7-3.el6_9.1`
`librelp` Red Hat:enterprise_linux:6::server	All versions	`0:1.2.7-3.el6_9.1`
`librelp-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:1.2.7-3.el6_9.1`
`librelp-devel` Red Hat:enterprise_linux:6::server	All versions	`0:1.2.7-3.el6_9.1`
`librelp` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.2.7-3.el6_9.1`
`librelp-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.2.7-3.el6_9.1`
`librelp-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.2.7-3.el6_9.1`
`librelp` Red Hat:enterprise_linux:7::client	All versions	`0:1.2.12-1.el7_5.1`
`librelp-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:1.2.12-1.el7_5.1`
`librelp-devel` Red Hat:enterprise_linux:7::client	All versions	`0:1.2.12-1.el7_5.1`
`librelp` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.2.12-1.el7_5.1`
`librelp-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.2.12-1.el7_5.1`
`librelp-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.2.12-1.el7_5.1`
`librelp` Red Hat:enterprise_linux:7::server	All versions	`0:1.2.12-1.el7_5.1`
`librelp-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1.2.12-1.el7_5.1`
`librelp-devel` Red Hat:enterprise_linux:7::server	All versions	`0:1.2.12-1.el7_5.1`
`librelp` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.2.12-1.el7_5.1`
`librelp-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.2.12-1.el7_5.1`
`librelp-devel` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.2.12-1.el7_5.1`
`librelp` Red Hat:rhel_aus:6.6::server	All versions	`0:1.2.7-3.el6_6.1`
`librelp-debuginfo` Red Hat:rhel_aus:6.6::server	All versions	`0:1.2.7-3.el6_6.1`
`librelp-devel` Red Hat:rhel_aus:6.6::server	All versions	`0:1.2.7-3.el6_6.1`
`librelp` Red Hat:rhel_aus:7.2::server	All versions	`0:1.2.0-4.el7_2`
`librelp-debuginfo` Red Hat:rhel_aus:7.2::server	All versions	`0:1.2.0-4.el7_2`
`librelp-devel` Red Hat:rhel_aus:7.2::server	All versions	`0:1.2.0-4.el7_2`
`librelp` Red Hat:rhel_e4s:7.2::server	All versions	`0:1.2.0-4.el7_2`
`librelp-debuginfo` Red Hat:rhel_e4s:7.2::server	All versions	`0:1.2.0-4.el7_2`
`librelp-devel` Red Hat:rhel_e4s:7.2::server	All versions	`0:1.2.0-4.el7_2`
`librelp` Red Hat:rhel_eus:6.7::computenode	All versions	`0:1.2.7-3.el6_7.1`
`librelp-debuginfo` Red Hat:rhel_eus:6.7::computenode	All versions	`0:1.2.7-3.el6_7.1`
`librelp-devel` Red Hat:rhel_eus:6.7::computenode	All versions	`0:1.2.7-3.el6_7.1`
`librelp` Red Hat:rhel_eus:6.7::server	All versions	`0:1.2.7-3.el6_7.1`
`librelp-debuginfo` Red Hat:rhel_eus:6.7::server	All versions	`0:1.2.7-3.el6_7.1`
`librelp-devel` Red Hat:rhel_eus:6.7::server	All versions	`0:1.2.7-3.el6_7.1`
`librelp` Red Hat:rhel_eus:7.3::computenode	All versions	`0:1.2.0-4.el7_3`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus and 3 more.

How do I fix CVE-2018-1000140?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-1000140 being exploited?

There is no known exploitation of CVE-2018-1000140 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-1000140, DSA-4151-1, GHSA-m73v-c2p6-943p, MGASA-2018-0251, RHSA-2018:1223, RHSA-2018:1225 and 12 more.