CVE-2018-1111 Command injection in dhcp
A malicious DHCP server can execute arbitrary commands with root privileges on Linux systems using NetworkManager due to a command injection flaw in the DHCP client script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1111?
CVE-2018-1111 is a high-severity command injection vulnerability in Fedoraproject Fedora, published on 17 May 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.
Which versions are affected by CVE-2018-1111?
It affects 7 products.
Linux distribution packages (40)
dhclient Red Hat:enterprise_linux:6::client | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp Red Hat:enterprise_linux:6::client | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-common Red Hat:enterprise_linux:6::client | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-debuginfo Red Hat:enterprise_linux:6::client | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-devel Red Hat:enterprise_linux:6::client | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhclient Red Hat:enterprise_linux:6::computenode | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp Red Hat:enterprise_linux:6::computenode | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-common Red Hat:enterprise_linux:6::computenode | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-devel Red Hat:enterprise_linux:6::computenode | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhclient Red Hat:enterprise_linux:6::server | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp Red Hat:enterprise_linux:6::server | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-common Red Hat:enterprise_linux:6::server | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-debuginfo Red Hat:enterprise_linux:6::server | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-devel Red Hat:enterprise_linux:6::server | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhclient Red Hat:enterprise_linux:6::workstation | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp Red Hat:enterprise_linux:6::workstation | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-common Red Hat:enterprise_linux:6::workstation | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhcp-devel Red Hat:enterprise_linux:6::workstation | All versions | 12:4.1.1-53.P1.el6_9.4 |
dhclient Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-68.el7_5.1 |
dhcp Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-common Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-debuginfo Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-devel Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-libs Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-68.el7_5.1 |
dhclient Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-68.el7_5.1 |
dhcp Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-common Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-devel Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-libs Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-68.el7_5.1 |
dhclient Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-68.el7_5.1 |
dhcp Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-common Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-debuginfo Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-devel Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-68.el7_5.1 |
dhcp-libs Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-68.el7_5.1 |
dhclient Red Hat:enterprise_linux:7::workstation | All versions | 12:4.2.5-68.el7_5.1 |
dhcp Red Hat:enterprise_linux:7::workstation | All versions | 12:4.2.5-68.el7_5.1 |
Products include Fedoraproject Fedora, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, Redhat Enterprise Virtualization and 1 more.
How do I fix CVE-2018-1111?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-1111 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-1111 exists.
Public exploit code: 1 Metasploit module, 3 Exploit-DB entries and 3 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-5jw9-5ff9-vr5p, RHSA-2018:1453, RHSA-2018:1454, RHSA-2018:1455, RHSA-2018:1456, RHSA-2018:1457 and 4 more.