PT-2018-10400 · Procps Ng+2 · Procps-Ng+2

Published 2018-05-17 · Updated 2026-05-26 · CVE-2018-1121

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions procps-ng versions prior to 3.3.15

Description The issue allows an unprivileged attacker to hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This is achieved through a process occupying a high PID using inotify events to determine when the process list is being scanned, and then fork/exec to obtain a lower PID, thus avoiding enumeration.

Recommendations For versions prior to 3.3.15, consider disabling the use of procps-ng's utilities until a patch is available, and restrict access to /proc/PID entries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Time Of Check To Time Of Use

Race Condition

Weakness Enumeration

CWE-367

CWE-362

Related Identifiers

ALT-PU-2019-3348

ALT-PU-2019-3353

CVE-2018-1121

ECHO-E5BF-9DF0-3BAA

Affected Products

Alt Linux

Debian

Procps-Ng

References · 17

• 🔥 https://exploit-db.com/exploits/44806 · Exploit
• 🔥 http://seclists.org/oss-sec/2018/q2/122 · Exploit
• 🔥 https://qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt · Exploit
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2018-1121 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1121 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1121 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1121 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2018-1121 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1121 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2018-1121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1121 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-1121 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1121 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2018-1121 · Vendor Advisory
• https://twitter.com/gcp_update_bot/status/1700407465077285237 · Twitter Post