CVE-2018-1000001

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• glibc - 'realpath()' Privilege Escalation (Metasploit)2018-06-13 · local · linux · Verified
• glibc < 2.26 - 'getcwd()' Local Privilege Escalation2018-01-16 · local · linux · Verified

Impact

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://seclists.org/oss-sec/2018/q1/38
• http://www.securityfocus.com/bid/102525
• http://www.securitytracker.com/id/1040162
• https://access.redhat.com/errata/RHSA-2018:0805
• https://security.netapp.com/advisory/ntap-20190404-0003/
• https://usn.ubuntu.com/3534-1/
• https://usn.ubuntu.com/3536-1/
• https://www.exploit-db.com/exploits/43775/
• https://www.exploit-db.com/exploits/44889/
• https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/
• http://seclists.org/oss-sec/2018/q1/38
• http://www.securityfocus.com/bid/102525
• http://www.securitytracker.com/id/1040162
• https://access.redhat.com/errata/RHSA-2018:0805
• https://security.netapp.com/advisory/ntap-20190404-0003/
• https://usn.ubuntu.com/3534-1/
• https://usn.ubuntu.com/3536-1/
• https://www.exploit-db.com/exploits/43775/
• https://www.exploit-db.com/exploits/44889/
• https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/