Description
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).
CVSS breakdown
CVSS 3.0
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected products
- Unknown / kernelkernel 4.17 – kernel 4.17
References
- VENDOR_ADVISORYhttps://usn.ubuntu.com/3752-2/
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:3083
- MISChttp://www.securityfocus.com/bid/104229
- VENDOR_ADVISORYhttps://usn.ubuntu.com/3752-3/
- MISChttps://security.gentoo.org/glsa/201805-14
- EXPLOIThttps://www.exploit-db.com/exploits/44806/
- VENDOR_ADVISORYhttps://usn.ubuntu.com/3910-1/
- MISChttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7f7ccc2ccc2e70c6054685f5e3522efa81556830
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1120
- VENDOR_ADVISORYhttps://usn.ubuntu.com/3910-2/
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2018/07/msg00020.html
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:2948
- MAILING_LISThttp://seclists.org/oss-sec/2018/q2/122
- VENDOR_ADVISORYhttps://usn.ubuntu.com/3752-1/
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:3096