CVE-2018-1121CWE-367

procps-ng, procps is vulnerable to a process hiding through race condition

Low · published June 13, 2018

CVSS v3.0
3.9
EPSS
4%
Percentile
90.7
In the wild
Unconfirmed
What it is

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.

The record
Technical detail
CVSS v3.0
3.9 · LOW
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.04105 · 90.7th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2018-06-13T20:00Z
EPSS history
Timeline
  • 13 JUN 20:00Z
    procps-ng, procps is vulnerable to a process hiding through race condition
    cvelistv5