CVE-2018-1121

Impact:
Low
Public Date:
2018-05-17
CWE:
CWE-367
Bugzilla:
1575473: CVE-2018-1121 procps-ng, procps: process hiding through race condition enumerating /proc
Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries.

Find out more about CVE-2018-1121 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

The /proc filesystem is not a reliable mechanism to account for processes running on a system, as it is unable to offer snapshot semantics. Short-lived processes have always been able to escape detection by tools that monitor /proc. This CVE simply identifies a reliable way to do so using inotify.

Process accounting for security purposes, or with a requirement to record very short-running processes and those attempting to evade detection, should be performed with more robust methods such as auditd(8) (the Linux Audit Daemon) or systemtap.

CVSS v3 metrics

NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.

CVSS3 Base Score 3.9
CVSS3 Base Metrics CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity Impact Low
Availability Impact Low

Affected Packages State

Platform Package State
Red Hat Enterprise Linux 7 procps-ng Will not fix
Red Hat Enterprise Linux 6 procps Will not fix
Red Hat Enterprise Linux 5 procps Will not fix

Acknowledgements

Red Hat would like to thank Qualys Research Labs for reporting this issue.

External References

Last Modified
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.