Bug 1575474 (CVE-2018-1123) - CVE-2018-1123 procps-ng, procps: denial of service in ps via mmap buffer overflow
Summary: CVE-2018-1123 procps-ng, procps: denial of service in ps via mmap buffer over...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-1123
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1577029 1577030 1579634
Blocks: 1575455
TreeView+ depends on / blocked
 
Reported: 2018-05-07 04:16 UTC by Doran Moppert
Modified: 2019-09-29 14:38 UTC (History)
6 users (show)

Fixed In Version: procps-ng 3.3.15
Doc Type: If docs needed, set a value
Doc Text:
Due to incorrect accounting when decoding and escaping Unicode data in procfs, ps is vulnerable to overflowing an mmap()ed region when formatting the process list for display. Since ps maps a guard page at the end of the buffer, impact is limited to a crash.
Clone Of:
Environment:
Last Closed: 2019-06-10 10:21:24 UTC


Attachments (Terms of Use)
Proposed patch (3.17 KB, patch)
2018-05-09 08:25 UTC, Adam Mariš
no flags Details | Diff

Description Doran Moppert 2018-05-07 04:16:24 UTC
Due to incorrect accounting when decoding and escaping Unicode data in procfs, ps is vulnerable to overflowing an mmap()ed region when formatting the process list for display.

Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).

Comment 1 Adam Mariš 2018-05-09 08:25:09 UTC
Created attachment 1433615 [details]
Proposed patch

Comment 2 Albert Cahalan 2018-05-09 08:55:31 UTC
Fixing this is best done by:

1. adjusting the calculation of OUTBUF_SIZE as needed for Unicode

2. limiting the amount of data that is read from /proc/*/* files

The proposed OUTBUF_SIZE_AT may solve the crash, but it adds slowness and does nothing to solve the denial-of-service that can hit when ps (or top) is required to hold all of that data in memory.

For example, consider a large number of processes with long command lines. This can be created on a relatively small system via the use of the clone() system call. Due to memory sharing there could be terabytes, or even petabytes, of command line data in /proc despite the system having a relatively modest amount of RAM. When ps is asked to show the command line and sort the output, all of this must be collected.

Comment 5 Adam Mariš 2018-05-16 11:17:51 UTC
Acknowledgments:

Name: Qualys Research Labs

Comment 6 Doran Moppert 2018-05-18 05:13:30 UTC
Public via: http://seclists.org/oss-sec/2018/q2/122

Comment 7 Doran Moppert 2018-05-18 05:13:37 UTC
External References:

https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt


Note You need to log in before you can comment on or make changes to this bug.