Red Hat Bugzilla – Bug 1575474
CVE-2018-1123 procps-ng, procps: denial of service in ps via mmap buffer overflow
Last modified: 2018-05-25 11:08:09 EDT
Due to incorrect accounting when decoding and escaping Unicode data in procfs, ps is vulnerable to overflowing an mmap()ed region when formatting the process list for display. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).
Created attachment 1433615 [details] Proposed patch
Fixing this is best done by: 1. adjusting the calculation of OUTBUF_SIZE as needed for Unicode 2. limiting the amount of data that is read from /proc/*/* files The proposed OUTBUF_SIZE_AT may solve the crash, but it adds slowness and does nothing to solve the denial-of-service that can hit when ps (or top) is required to hold all of that data in memory. For example, consider a large number of processes with long command lines. This can be created on a relatively small system via the use of the clone() system call. Due to memory sharing there could be terabytes, or even petabytes, of command line data in /proc despite the system having a relatively modest amount of RAM. When ps is asked to show the command line and sort the output, all of this must be collected.
Acknowledgments: Name: Qualys Research Labs
Public via: http://seclists.org/oss-sec/2018/q2/122
External References: https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt