Privilege escalation in Linux kernel - CVE-2018-1000001

Vulnerability identifier: #VU9992

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000001

CWE-ID: CWE-124

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in due to a change in the processing of pathnames in the getcwd() command introduced in Linux kernel. A local attacker can use a specially crafted application, trigger buffer underflow in the __realpath() function in 'stdlib/canonicalize.c' and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

Linux kernel
Arch Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
SUSE Linux
Ubuntu
Fedora
Opensuse
Red Hat Virtualization Host
Dynamic System Analysis (DSA) Preboot
Integrated Management Module II (IMM2) for BladeCenter Systems
System x Integrated Management Module (IMM2)
Flex System Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)
glibc
glibc-arm-linux-gnu

Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.

Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
System x Integrated Management Module (IMM2) - update to 1AOO84C-6.80
Flex System Integrated Management Module (IMM2) - update to 1AOO84C-6.80
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO84C-6.80-bc
Flex System Chassis Management Module (CMM) - update to 2pet16c-2.5.12c
glibc - addressed in versions 2.25-13.fc26, 2.26-24.fc27
glibc-arm-linux-gnu - addressed in versions 2.26-4.fc26, 2.26-4.fc27

• Exploit #6355 - glibc - 'realpath()' Privilege Escalation (Metasploit) (June 17, 2021)
• Exploit #2384 - CVE-Exploit-Script () (April 7, 2020)
• Exploit #1814 - glibc 'realpath()' Privilege Escalation (March 18, 2020)

• https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/

• Privilege escalation in Glibc
• SUSE Linux update for glibc
• Ubuntu update for GNU C Library
• Arch Linux update for glibc
• Arch Linux update for lib32-glibc
• SUSE Linux update for glibc
• Gentoo update for glibc
• SUSE Linux update for glibc
• OpenSUSE Linux update for glibc
• SUSE Linux update for glibc
• Amazon Linux AMI update for glibc
• Red Hat update for glibc
• OpenSUSE Linux update for glibc
• SUSE Linux update for glibc
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Multiple vulnerabilities in IBM Integrated Management Module II (IMM2)
• Fedora 27 update for glibc
• Fedora 26 update for glibc
• Fedora 26 update for glibc-arm-linux-gnu
• Fedora 27 update for glibc-arm-linux-gnu