CVE-2018-1121 Race condition in procps-ng, procps
An unprivileged attacker can hide processes from system monitoring tools by exploiting a race condition in procps-ng utilities.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1121?
CVE-2018-1121 is a low-severity vulnerability in [UNKNOWN] procps-ng, procps, published on 13 Jun 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.
Which versions are affected by CVE-2018-1121?
It affects 1 product.
Products include Procps Project Procps.
How do I fix CVE-2018-1121?
Apply the vendor's patch.
Is CVE-2018-1121 being exploited?
There is no known exploitation of CVE-2018-1121 in the wild and no public exploit code.
Public exploit code: 2 Exploit-DB entries.
Sources
Also known as DEBIAN-CVE-2018-1121, GHSA-2r59-6pxx-3wqv, ROOT-OS-DEBIAN-12-CVE-2018-1121, ROOT-OS-DEBIAN-13-CVE-2018-1121, ROOT-OS-UBUNTU-2204-CVE-2018-1121, ROOT-OS-UBUNTU-2404-CVE-2018-1121 and 1 more.