NetSight
IP …
high7.3Public exploit code

CVE-2018-1122

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.

Affected products

VendorProductAffected versions
Procps-Ng ProjectProcps-Ng
before 3.3.15
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 17.10, 18.04
DebianDebian Linux
Versions 7.0, 8.0, 9.0

Weakness classification

CWE-829

References