|Summary:||CVE-2018-1123 procps-ng, procps: denial of service in ps via mmap buffer overflow|
|Product:||[Other] Security Response||Reporter:||Doran Moppert <dmoppert>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED WONTFIX||QA Contact:|
|Version:||unspecified||CC:||albert, dmoppert, jaromir.capik, jrybar, kdudka, security-response-team|
|Fixed In Version:||procps-ng 3.3.15||Doc Type:||If docs needed, set a value|
Due to incorrect accounting when decoding and escaping Unicode data in procfs, ps is vulnerable to overflowing an mmap()ed region when formatting the process list for display. Since ps maps a guard page at the end of the buffer, impact is limited to a crash.
|Last Closed:||2019-06-10 10:21:24 UTC||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:||1577029, 1577030, 1579634|
Description Doran Moppert 2018-05-07 04:16:24 UTC
Due to incorrect accounting when decoding and escaping Unicode data in procfs, ps is vulnerable to overflowing an mmap()ed region when formatting the process list for display. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).
Comment 2 Albert Cahalan 2018-05-09 08:55:31 UTC
Fixing this is best done by: 1. adjusting the calculation of OUTBUF_SIZE as needed for Unicode 2. limiting the amount of data that is read from /proc/*/* files The proposed OUTBUF_SIZE_AT may solve the crash, but it adds slowness and does nothing to solve the denial-of-service that can hit when ps (or top) is required to hold all of that data in memory. For example, consider a large number of processes with long command lines. This can be created on a relatively small system via the use of the clone() system call. Due to memory sharing there could be terabytes, or even petabytes, of command line data in /proc despite the system having a relatively modest amount of RAM. When ps is asked to show the command line and sort the output, all of this must be collected.
Comment 5 Adam Mariš 2018-05-16 11:17:51 UTC
Acknowledgments: Name: Qualys Research Labs
Comment 7 Doran Moppert 2018-05-18 05:13:37 UTC
External References: https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt