NetSight
IP …
low2.8Public exploit code

CVE-2018-1120

A flaw was found affecting the Linux kernel before version 4.17.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 4.17
RedhatVirtualization Host
Version 4.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Workstation
Version 7.0
DebianDebian Linux
Version 8.0
CanonicalUbuntu Linux
Versions 16.04, 18.04

Weakness classification

CWE-122CWE-119

References