CVE-2018-1124

Name of the Vulnerable Software and Affected Versions procps-ng versions prior to 3.3.15

Description The issue is caused by an integer overflow in the file2strvec function of the procps-ng set of console applications for monitoring and terminating system processes. This can allow an attacker to execute arbitrary code, potentially leading to privilege escalation for a local attacker who can create entries in procfs by starting processes. The exploitation could result in crashes or arbitrary code execution in proc utilities run by other users.

Recommendations For procps-ng versions prior to 3.3.15, update to version 3.3.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the file2strvec function until a patch is available.