Skip to content
Fencer Intel
low 3.9

CVE-2018-1121 json

procps-ng, procps is vulnerable to a process hiding through race condition.

published 2018-06-13 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-11765

cvss
3.9
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.1%
EPSS 4.1% chance of exploitation in 30 days, percentile 90%
public exploits
1
Exploit-DB

Summary

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.

Patch / fix

  • linux Arch Linux 4.17.2-1
  • linux-lts Arch Linux 4.14.44-1
  • linux-hardened Arch Linux 4.17a-1
  • linux-zen Arch Linux 4.17-1

arch linux advisories AVG-701AVG-702AVG-703AVG-704

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1121 updated cvss 3.9

procps: process hiding through race condition enumerating /proc

  • Red Hat Enterprise Linux 5 procps Red Hat Enterprise Linux 6 procps Red Hat Enterprise Linux 7 procps-ng, procps-ng-i18n Red Hat Enterprise Linux 8 procps-ng, procps-ng-i18n
    affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-44806)
  2. Published

Exploit prediction

4.11% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-44806 Procps-ng - Multiple Vulnerabilities local, 2018-05-30
  • seclists.org http://seclists.org/oss-sec/2018/q2/122 referenced PoC, tagged "exploit" by a source, unverified
  • qualys.com https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
NVD 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • [UNKNOWN] procps-ng, procps

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.