CVE-2018-1122: canonical ubuntu_linux
Vulnerability summary
CVE-2018-1122 is a high (CVSS 7.3) vulnerability in canonical ubuntu_linux. EPSS estimates a 1.27% chance of exploitation in the next 30 days, higher than 69.4% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 12 · Related 10Timeline
- 23-05-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.
CVSS metrics
6 scores · 5 sources · 2 versions- NVDNIST7.0HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · Red hatEcosystem advisory · calculated6.7MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.0HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.27%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
-0.03 pp
From 1.30% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (qualys.com)
Maturity: unknown
Procps-ng - Multiple Vulnerabilities
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat4 products
- procps-ng< 0:3.3.10-16.el7_4.2 | < 0:3.3.10-26.el7 | < 0:3.3.10-17.el7_5.4 | < 0:3.3.10-23.el7_6.2
- procps-ng-debuginfo< 0:3.3.10-16.el7_4.2 | < 0:3.3.10-26.el7 | < 0:3.3.10-17.el7_5.4 | < 0:3.3.10-23.el7_6.2
- procps-ng-devel< 0:3.3.10-16.el7_4.2 | < 0:3.3.10-26.el7 | < 0:3.3.10-17.el7_5.4 | < 0:3.3.10-23.el7_6.2
- procps-ng-i18n< 0:3.3.10-16.el7_4.2 | < 0:3.3.10-26.el7 | < 0:3.3.10-17.el7_5.4 | < 0:3.3.10-23.el7_6.2
Debian2 products
- procps< 2:3.3.15-1
- debian_linuxEOL7.0 | 8.0 | 9.0
[unknown]1 product
- procps-ng, procpsprocps-ng 3.3.15
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 17.10 | 18.04
Procps-ng_project1 product
- procps-ng< 3.3.15
Ubuntu1 product
- procps< 1:3.3.9-1ubuntu2.3 | < 2:3.3.10-4ubuntu2.4 | < 2:3.3.12-3ubuntu1.1
6 vendors · 10 products
References
32 links
- lists.debian.org/debian-lts-announce/2018/05/msg00021.htmlMailing ListX Refsource MLISTThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122X Refsource CONFIRMIssue TrackingThird Party Advisory
- www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txtX Refsource MISCExploitThird Party AdvisoryARTICLEREPORT
