PT-2018-3531 · Linux+5 · Linux Kernel+5
Published
2018-05-17
·
Updated
2019-10-09
·
CVE-2018-1120
CVSS v2.0
6.3
Medium
| Vector | AV:N/AC:M/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 4.17
Description:
A flaw in the Linux kernel allows an attacker to cause a denial of service or create a synchronization primitive for other attacks by mmap()ing a FUSE-backed file onto a process's memory containing command line arguments or environment strings. This can cause utilities such as ps or w to block indefinitely when making a read() call to the /proc//cmdline or /proc//environ files.
Recommendations:
For Linux kernel versions prior to 4.17, consider restricting access to the
mmap() function or limiting the use of FUSE-backed files to minimize the risk of exploitation. As a temporary workaround, avoid using utilities that make read() calls to the /proc//cmdline or /proc//environ files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Heap Based Buffer Overflow
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu