CVE-2018-1120: Buffer Overflow
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).
Other sources
By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).
External references:
http://seclists.org/oss-sec/2018/q2/122
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7f7ccc2ccc2e70c6054685f5e3522efa81556830
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.17 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1120?
CVE-2018-1120 is classified as a high severity vulnerability affecting the Linux kernel.
How do I fix CVE-2018-1120?
To mitigate CVE-2018-1120, upgrade to Linux kernel version 4.17 or later.
What versions of the Linux kernel are affected by CVE-2018-1120?
CVE-2018-1120 affects Linux kernel versions prior to 4.17.
Which distributions are known to be affected by CVE-2018-1120?
Debian, Red Hat Enterprise Linux, and Ubuntu versions prior to their respective patches are affected by CVE-2018-1120.
Can CVE-2018-1120 be exploited remotely?
CVE-2018-1120 requires local access for exploitation, as it involves mmap()ing vulnerable file systems.