vulnwire
7.3high

CVE-2018-11241 exploit

procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function.

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.3
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 79%
Public exploits
1
Exploit-DB

procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
10 mo ago

Exploit prediction (EPSS)

1.86% probability of exploitation in the next 30 days, higher than 79% of all scored CVEs.

Exploits and detections

  • EDB-44806 Procps-ng - Multiple Vulnerabilities · local · 2018-05-30

CVSS scores

Assigned byVersionScoreVector
CNA3.07.3CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA3.07.3CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • [UNKNOWN] procps-ng

Classification

Weakness

References

  • usn.ubuntu.com /3658-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2018-1124 · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2018/dsa-4208 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • security.gentoo.org /glsa/201805-14 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • exploit-db.com /exploits/44806/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • access.redhat.com /errata/RHSA-2018:1777 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • kc.mcafee.com /corporate/index?page=content&id=SB10241 · x_refsource_CONFIRM, x_transferred
  • lists.debian.org /debian-lts-announce/2018/05/msg00021.html · mailing-list, x_refsource_MLIST, x_transferred
  • access.redhat.com /errata/RHSA-2018:2267 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:2268 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1700 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • help.ecostruxureit.com /display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/104214 · vdb-entry, x_refsource_BID, x_transferred
  • seclists.org /oss-sec/2018/q2/122 · mailing-list, x_refsource_MLIST, x_transferred
  • securitytracker.com /id/1041057 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • access.redhat.com /errata/RHSA-2018:1820 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • usn.ubuntu.com /3658-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • qualys.com /2018/05/17/procps-ng-audit-report-advisory.txt · x_refsource_MISC, x_transferred
  • access.redhat.com /errata/RHSA-2019:1944 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:2401 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2019-10/msg00058.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2019-10/msg00059.html · vendor-advisory, x_refsource_SUSE, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.