SB2020121709 - Denial of service in F5 Networks BIG-IP products
Published: December 17, 2020
Security Bulletin ID
SB2020121709
Severity
Low
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper input validation (CVE-ID: CVE-2018-1120)
The vulnerability allows a local user to cause DoS condition on the target system.The weakness exists due to insufficient validation of user-supplied input. A local user can block any read() access to /proc/PID/cmdline by mmap()ing a FUSE file (Filesystem in Userspace) onto this process's command-line arguments, block pgrep, pidof, pkill, ps, and w, either forever (a denial of service), or for some controlled time (a synchronization tool for exploiting other vulnerabilities).
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.