Issued:
2018-05-31
Updated:
2018-05-31

RHSA-2018:1777 - Security Advisory

Synopsis

Important: procps security update

Type/Severity

Security Advisory: Important

Topic

An update for procps is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The procps packages contain a set of system utilities that provide system information. The procps packages include the following utilities: ps, free, skill, pkill, pgrep, snice, tload, top, uptime, vmstat, w, watch, pwdx, sysctl, pmap, and slabtop.

Security Fix(es):

  • procps-ng, procps: Integer overflows leading to heap overflow in file2strvec (CVE-2018-1124)
  • procps-ng, procps: incorrect integer size in proc/alloc.* leading to truncation / integer overflow issues (CVE-2018-1126)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Qualys Research Labs for reporting these issues.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server 6 x86_64
  • Red Hat Enterprise Linux Server 6 i386
  • Red Hat Enterprise Linux Workstation 6 x86_64
  • Red Hat Enterprise Linux Workstation 6 i386
  • Red Hat Enterprise Linux Desktop 6 x86_64
  • Red Hat Enterprise Linux Desktop 6 i386
  • Red Hat Enterprise Linux for IBM z Systems 6 s390x
  • Red Hat Enterprise Linux for Power, big endian 6 ppc64
  • Red Hat Enterprise Linux for Scientific Computing 6 x86_64

Fixes

  • BZ - 1575465 - CVE-2018-1124 procps-ng, procps: Integer overflows leading to heap overflow in file2strvec
  • BZ - 1575853 - CVE-2018-1126 procps-ng, procps: incorrect integer size in proc/alloc.* leading to truncation / integer overflow issues

CVEs

References

Red Hat Enterprise Linux Server 6

SRPM
procps-3.2.8-45.el6_9.3.src.rpm SHA-256: 09cca7db5f4f643c37f5facaf9b926473ac63d8270941d0f68ced439b16bb386
x86_64
procps-3.2.8-45.el6_9.3.i686.rpm SHA-256: 7699941a2a35df169508986b46eee5c9aa6e1cadbffa1aac84dc85934a37ad86
procps-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: b7a272a1be8e44491a5a95fb0d65adef83e413f8ab8fb63a4378556d75f0aeba
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-debuginfo-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: 9e6cb607581ae71465e70225b4c232064716b409918f135196e1212ed00c78eb
procps-debuginfo-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: 9e6cb607581ae71465e70225b4c232064716b409918f135196e1212ed00c78eb
procps-devel-3.2.8-45.el6_9.3.i686.rpm SHA-256: e44a6d611aa5225f53b6306cd310859dbd1b6625d5a6d786145d838ff1084827
procps-devel-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: ccbf18039f6cf79833d13a496fff7d461ae00dd8e41c85ab31924e0abc4d0d21
i386
procps-3.2.8-45.el6_9.3.i686.rpm SHA-256: 7699941a2a35df169508986b46eee5c9aa6e1cadbffa1aac84dc85934a37ad86
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-devel-3.2.8-45.el6_9.3.i686.rpm SHA-256: e44a6d611aa5225f53b6306cd310859dbd1b6625d5a6d786145d838ff1084827

Red Hat Enterprise Linux Workstation 6

SRPM
procps-3.2.8-45.el6_9.3.src.rpm SHA-256: 09cca7db5f4f643c37f5facaf9b926473ac63d8270941d0f68ced439b16bb386
x86_64
procps-3.2.8-45.el6_9.3.i686.rpm SHA-256: 7699941a2a35df169508986b46eee5c9aa6e1cadbffa1aac84dc85934a37ad86
procps-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: b7a272a1be8e44491a5a95fb0d65adef83e413f8ab8fb63a4378556d75f0aeba
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-debuginfo-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: 9e6cb607581ae71465e70225b4c232064716b409918f135196e1212ed00c78eb
procps-debuginfo-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: 9e6cb607581ae71465e70225b4c232064716b409918f135196e1212ed00c78eb
procps-devel-3.2.8-45.el6_9.3.i686.rpm SHA-256: e44a6d611aa5225f53b6306cd310859dbd1b6625d5a6d786145d838ff1084827
procps-devel-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: ccbf18039f6cf79833d13a496fff7d461ae00dd8e41c85ab31924e0abc4d0d21
i386
procps-3.2.8-45.el6_9.3.i686.rpm SHA-256: 7699941a2a35df169508986b46eee5c9aa6e1cadbffa1aac84dc85934a37ad86
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-devel-3.2.8-45.el6_9.3.i686.rpm SHA-256: e44a6d611aa5225f53b6306cd310859dbd1b6625d5a6d786145d838ff1084827

Red Hat Enterprise Linux Desktop 6

SRPM
procps-3.2.8-45.el6_9.3.src.rpm SHA-256: 09cca7db5f4f643c37f5facaf9b926473ac63d8270941d0f68ced439b16bb386
x86_64
procps-3.2.8-45.el6_9.3.i686.rpm SHA-256: 7699941a2a35df169508986b46eee5c9aa6e1cadbffa1aac84dc85934a37ad86
procps-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: b7a272a1be8e44491a5a95fb0d65adef83e413f8ab8fb63a4378556d75f0aeba
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-debuginfo-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: 9e6cb607581ae71465e70225b4c232064716b409918f135196e1212ed00c78eb
procps-debuginfo-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: 9e6cb607581ae71465e70225b4c232064716b409918f135196e1212ed00c78eb
procps-devel-3.2.8-45.el6_9.3.i686.rpm SHA-256: e44a6d611aa5225f53b6306cd310859dbd1b6625d5a6d786145d838ff1084827
procps-devel-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: ccbf18039f6cf79833d13a496fff7d461ae00dd8e41c85ab31924e0abc4d0d21
i386
procps-3.2.8-45.el6_9.3.i686.rpm SHA-256: 7699941a2a35df169508986b46eee5c9aa6e1cadbffa1aac84dc85934a37ad86
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-devel-3.2.8-45.el6_9.3.i686.rpm SHA-256: e44a6d611aa5225f53b6306cd310859dbd1b6625d5a6d786145d838ff1084827

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
procps-3.2.8-45.el6_9.3.src.rpm SHA-256: 09cca7db5f4f643c37f5facaf9b926473ac63d8270941d0f68ced439b16bb386
s390x
procps-3.2.8-45.el6_9.3.s390.rpm SHA-256: 0f3aa17b245995186cbfceeb942939ccb02f3bad29da6cdda5d03ca275c94c3e
procps-3.2.8-45.el6_9.3.s390x.rpm SHA-256: e3d88e3d6d56d1749034eaa46d8da3660c299ecdc13bc53cd5c792667e1dde0b
procps-debuginfo-3.2.8-45.el6_9.3.s390.rpm SHA-256: 59a88fbf10ca11387502aad1d6bd31e0bbee44887f19f6d9b7ed018c0a6297b6
procps-debuginfo-3.2.8-45.el6_9.3.s390.rpm SHA-256: 59a88fbf10ca11387502aad1d6bd31e0bbee44887f19f6d9b7ed018c0a6297b6
procps-debuginfo-3.2.8-45.el6_9.3.s390x.rpm SHA-256: 0adb47d3b35fbe09a7f47500a90860c566cc7e62215966e3f021211578911f80
procps-debuginfo-3.2.8-45.el6_9.3.s390x.rpm SHA-256: 0adb47d3b35fbe09a7f47500a90860c566cc7e62215966e3f021211578911f80
procps-devel-3.2.8-45.el6_9.3.s390.rpm SHA-256: 6ad267790aa4520cd05343a0b132766bc49a39b1485ad9bfff17320a61db33e8
procps-devel-3.2.8-45.el6_9.3.s390x.rpm SHA-256: 06438b9cb1c0a14d46d9acd89ee9c41be27e59d08e222616153ac6d6c427f8ed

Red Hat Enterprise Linux for Power, big endian 6

SRPM
procps-3.2.8-45.el6_9.3.src.rpm SHA-256: 09cca7db5f4f643c37f5facaf9b926473ac63d8270941d0f68ced439b16bb386
ppc64
procps-3.2.8-45.el6_9.3.ppc.rpm SHA-256: 85cb87288a68a1b60d2245f92988f5c76507c770932e9ebd950c61d24ed75b63
procps-3.2.8-45.el6_9.3.ppc64.rpm SHA-256: c0cf4e63d3461871d5577ba5f372daf4aea1c62a40d318df79a68bb9e0fdc259
procps-debuginfo-3.2.8-45.el6_9.3.ppc.rpm SHA-256: 41257c5370c08a6e8c19cc36956fa6077c9a45db31bd1b505383e5f99bb5bab1
procps-debuginfo-3.2.8-45.el6_9.3.ppc.rpm SHA-256: 41257c5370c08a6e8c19cc36956fa6077c9a45db31bd1b505383e5f99bb5bab1
procps-debuginfo-3.2.8-45.el6_9.3.ppc64.rpm SHA-256: 2439f8a66c3494de84e3d28bd7820eaaf5f8872cffaa16fd30eacd0bd60daab7
procps-debuginfo-3.2.8-45.el6_9.3.ppc64.rpm SHA-256: 2439f8a66c3494de84e3d28bd7820eaaf5f8872cffaa16fd30eacd0bd60daab7
procps-devel-3.2.8-45.el6_9.3.ppc.rpm SHA-256: 4e93923882a7ab54d6f2565d6196a72744f334e39362d51ad908a6d88abcf84a
procps-devel-3.2.8-45.el6_9.3.ppc64.rpm SHA-256: e3761e927ac9327a004ef129f755140ab417478858172be9bb631bd4088e3154

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
procps-3.2.8-45.el6_9.3.src.rpm SHA-256: 09cca7db5f4f643c37f5facaf9b926473ac63d8270941d0f68ced439b16bb386
x86_64
procps-3.2.8-45.el6_9.3.i686.rpm SHA-256: 7699941a2a35df169508986b46eee5c9aa6e1cadbffa1aac84dc85934a37ad86
procps-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: b7a272a1be8e44491a5a95fb0d65adef83e413f8ab8fb63a4378556d75f0aeba
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-debuginfo-3.2.8-45.el6_9.3.i686.rpm SHA-256: 360054b136685164fb6db509523b9de35529cd365dddb3e581444049dc9589aa
procps-debuginfo-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: 9e6cb607581ae71465e70225b4c232064716b409918f135196e1212ed00c78eb
procps-debuginfo-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: 9e6cb607581ae71465e70225b4c232064716b409918f135196e1212ed00c78eb
procps-devel-3.2.8-45.el6_9.3.i686.rpm SHA-256: e44a6d611aa5225f53b6306cd310859dbd1b6625d5a6d786145d838ff1084827
procps-devel-3.2.8-45.el6_9.3.x86_64.rpm SHA-256: ccbf18039f6cf79833d13a496fff7d461ae00dd8e41c85ab31924e0abc4d0d21

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.