CVE-2018-1121: Race Condition
procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's procpidreaddir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1121?
CVE-2018-1121 is classified as a medium severity vulnerability.
How do I fix CVE-2018-1121?
To mitigate CVE-2018-1121, update procps-ng to a version later than 3.3.15.
What type of vulnerability is CVE-2018-1121?
CVE-2018-1121 is a race condition vulnerability that allows process hiding.
Which versions of procps are affected by CVE-2018-1121?
CVE-2018-1121 affects procps-ng versions up to and including 3.3.15.
Can CVE-2018-1121 lead to security risks?
Yes, CVE-2018-1121 can allow unauthorized processes to hide from the process list, posing a security risk.