Process Hiding Vulnerability in Linux Package: CVE-2018-1121
Summary
DEBIAN-CVE-2018-1121: procps-ng, procps is vulnerable to a process hiding through race condition. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package, specifically procps and procps-ng, is a set of utilities that provide information about processes running on a system. These tools are essential for system monitoring and management, allowing users to view and control system processes. However, a vulnerability has been identified that allows unprivileged attackers to exploit a race condition, potentially leading to process hiding.
Vulnerability Detail
CVE-2018-1121 is a vulnerability in procps-ng and procps that arises from a race condition in the reading of /proc/PID entries. The kernel's proc_pid_readdir() function returns PID entries in ascending numeric order. An attacker can leverage inotify events to detect when the process list is being scanned and then fork/exec to obtain a lower PID, effectively hiding their process from the utilities provided by procps-ng. This vulnerability affects versions up to 3.3.15, and while newer versions may also be affected, they have not been explicitly tested.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, system administrators can monitor process creation and termination closely, and implement stricter access controls to sensitive processes. However, this does not eliminate the vulnerability and should not be considered a permanent solution.
Conclusion
CVE-2018-1121 represents a significant security risk for systems using procps and procps-ng, allowing attackers to hide processes. It is crucial to update to the latest versions of these packages to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2018-1121 is a vulnerability in the procps-ng and procps packages that allows unprivileged attackers to hide processes through a race condition.
Versions of procps and procps-ng up to 3.3.15 are affected by this vulnerability.
You can use the Vulert platform to check if your application is affected by this vulnerability without needing to install any software.
If you cannot update the package, consider implementing stricter access controls and monitoring process activities as a temporary measure.
More information can be found in the official CVE database and on the Vulert website, which provides real-time monitoring for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
