CVE-2018-1120 Denial of service in kernel

Low 2.8 Published 20 Jun 2018 Updated 5 Aug 2024

An attacker can cause system utilities to block indefinitely by mapping a FUSE-backed file onto process memory, leading to denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-1120?

CVE-2018-1120 is a low-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 20 Jun 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).

Weakness: CWE-119, CWE-122

Which versions are affected by CVE-2018-1120?

It affects 7 products.

Linux distribution packages (40)

`kernel-rt` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-debug` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-debug-debuginfo` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-debug-devel` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-debuginfo` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-debuginfo-common-x86_64` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-devel` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-doc` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-firmware` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-trace` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-trace-debuginfo` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-trace-devel` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-vanilla` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-vanilla-debuginfo` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel-rt-vanilla-devel` Red Hat:enterprise_mrg:2:server:el6	All versions	`1:3.10.0-693.76.1.rt56.676.el6rt`
`kernel` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-abi-whitelists` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-debug` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-debug-debuginfo` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-debug-devel` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-debuginfo` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-debuginfo-common-x86_64` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-devel` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-doc` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-tools` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-tools-debuginfo` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-tools-libs` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-tools-libs-devel` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`perf` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`perf-debuginfo` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`python-perf` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`python-perf-debuginfo` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel` Red Hat:rhel_e4s:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-abi-whitelists` Red Hat:rhel_e4s:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-bootwrapper` Red Hat:rhel_e4s:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-debug` Red Hat:rhel_e4s:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-debug-debuginfo` Red Hat:rhel_e4s:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-debug-devel` Red Hat:rhel_e4s:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-debuginfo` Red Hat:rhel_e4s:7.4::server	All versions	`0:3.10.0-693.76.1.el7`
`kernel-debuginfo-common-ppc64le` Red Hat:rhel_e4s:7.4::server	All versions	`0:3.10.0-693.76.1.el7`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Linux kernel, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation and 1 more.

How do I fix CVE-2018-1120?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-1120 being exploited?

There is no known exploitation of CVE-2018-1120 in the wild and no public exploit code.

Public exploit code: 2 Exploit-DB entries.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-1120, GHSA-gq4w-28gq-c8cj, RHSA-2020:3804, RHSA-2020:3810, UBUNTU-CVE-2018-1120.