high 7.3

CVE-2018-1122 json

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top.

published 2018-05-23 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-11766

cvss: 7.3; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits: 1; Exploit-DB

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.

Patch / fix

fixed in 1 distros 6

procps-ng_project procps-ng 3.3.15

debian ubuntu red hat suse opensuse arch linux

procps Debian 14, Debian 13, Debian 12 2:3.3.15-1

debian advisories DEBIAN-CVE-2018-1122

procps Ubuntu 14.04 LTS 1:3.3.9-1ubuntu2.3
procps Ubuntu 16.04 LTS 2:3.3.10-4ubuntu2.4
procps Ubuntu 18.04 LTS 2:3.3.12-3ubuntu1.1

ubuntu advisories UBUNTU-CVE-2018-1122

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

procps-ng RHEL 7 3.3.10-26.el7
procps-ng-i18n RHEL 7 3.3.10-26.el7
procps-ng RHEL 7.6 EUS 3.3.10-23.el7_6.2
procps-ng-i18n RHEL 7.6 EUS 3.3.10-23.el7_6.2
procps-ng RHEL 7.5 EUS 3.3.10-17.el7_5.4
procps-ng-i18n RHEL 7.5 EUS 3.3.10-17.el7_5.4
procps-ng RHEL 7.4 TUS, RHEL 7.4 E4S, RHEL 7.4 AUS 3.3.10-16.el7_4.2
procps-ng-i18n RHEL 7.4 TUS, RHEL 7.4 E4S, RHEL 7.4 AUS 3.3.10-16.el7_4.2

red hat advisories RHSA-2020:1464 RHSA-2020:1265 RHSA-2020:0595 RHSA-2019:2189

procps SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 3.3.15-7.7.26
procps SLES 12 SP4, SLES 12 SP3, SLES 12 SP2-BCL +13 more 3.3.9-11.18.1
procps SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +1 more 3.3.9-11.14.1
procps SLES for SAP 11 SP4, SLES 11 SP4 3.2.7-152.31.1
procps SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +1 more 3.3.9-11.11.1

suse advisories SUSE-SU-2019:2730-1 SUSE-SU-2019:0450-2 SUSE-SU-2019:0450-1 SUSE-SU-2018:2451-2 SUSE-SU-2018:2042-1 SUSE-SU-2018:1836-1

procps openSUSE Tumbleweed 3.3.17-5.2
procps openSUSE Leap 15.0 3.3.15-lp150.5.3.1
procps openSUSE Leap 15.1 3.3.15-lp151.6.3.1

opensuse advisories openSUSE-SU-2024:11195-1 openSUSE-SU-2019:2379-1 openSUSE-SU-2019:2376-1

procps-ng Arch Linux 3.3.15-1

arch linux advisories AVG-705

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1122 updated 2026-11-05 cvss 6.7

procps: Local privilege escalation in top

Red Hat Enterprise Linux 5 procps Red Hat Enterprise Linux 6 procps
affected: no fix planned “Will not fix”
Red Hat Ansible Tower 3.4 for RHEL 7 Server ansible-tower-34/ansible-tower-memcached 1.4.15-28, ansible-tower-35/ansible-tower-memcached 1.4.15-28, ansible-tower-37/ansible-tower-memcached-rhel7 1.4.15-28
fixed: vendor fix RHBA-2020:0547
Red Hat Enterprise Linux Client (v. 7) procps-ng 3.3.10-26.el7 Red Hat Enterprise Linux Client Optional (v. 7) procps-ng-i18n 3.3.10-26.el7 Red Hat Enterprise Linux ComputeNode (v. 7) procps-ng 3.3.10-26.el7
fixed: vendor fix RHSA-2019:2189
Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) procps-ng 3.3.10-17.el7_5.4
fixed: vendor fix RHSA-2020:1265
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) procps-ng 3.3.10-23.el7_6.2
fixed: vendor fix RHSA-2020:1464
Red Hat Enterprise Linux ComputeNode Optional (v. 7) procps-ng-i18n 3.3.10-26.el7
fixed: vendor fix RHSA-2019:2189
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) procps-ng-i18n 3.3.10-17.el7_5.4
fixed: vendor fix RHSA-2020:1265
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) procps-ng-i18n 3.3.10-23.el7_6.2 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) procps-ng 3.3.10-23.el7_6.2 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) procps-ng-i18n 3.3.10-23.el7_6.2
fixed: vendor fix RHSA-2020:1464

show 11 more

Red Hat Enterprise Linux Server (v. 7) procps-ng 3.3.10-26.el7
fixed: vendor fix RHSA-2019:2189
Red Hat Enterprise Linux Server AUS (v. 7.4) procps-ng 3.3.10-16.el7_4.2 Red Hat Enterprise Linux Server E4S (v. 7.4) procps-ng 3.3.10-16.el7_4.2
fixed: vendor fix RHSA-2020:0595
Red Hat Enterprise Linux Server EUS (v. 7.5) procps-ng 3.3.10-17.el7_5.4
fixed: vendor fix RHSA-2020:1265
Red Hat Enterprise Linux Server EUS (v. 7.6) procps-ng 3.3.10-23.el7_6.2
fixed: vendor fix RHSA-2020:1464
Red Hat Enterprise Linux Server Optional (v. 7) procps-ng-i18n 3.3.10-26.el7
fixed: vendor fix RHSA-2019:2189
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) procps-ng-i18n 3.3.10-16.el7_4.2 Red Hat Enterprise Linux Server Optional E4S (v. 7.4) procps-ng-i18n 3.3.10-16.el7_4.2
fixed: vendor fix RHSA-2020:0595
Red Hat Enterprise Linux Server Optional EUS (v. 7.5) procps-ng-i18n 3.3.10-17.el7_5.4
fixed: vendor fix RHSA-2020:1265
Red Hat Enterprise Linux Server Optional EUS (v. 7.6) procps-ng-i18n 3.3.10-23.el7_6.2
fixed: vendor fix RHSA-2020:1464
Red Hat Enterprise Linux Server Optional TUS (v. 7.4) procps-ng-i18n 3.3.10-16.el7_4.2 Red Hat Enterprise Linux Server TUS (v. 7.4) procps-ng 3.3.10-16.el7_4.2
fixed: vendor fix RHSA-2020:0595
Red Hat Enterprise Linux Workstation (v. 7) procps-ng 3.3.10-26.el7 Red Hat Enterprise Linux Workstation Optional (v. 7) procps-ng-i18n 3.3.10-26.el7
fixed: vendor fix RHSA-2019:2189
Red Hat Enterprise Linux 8 procps-ng, procps-ng-i18n
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2018-05-23 Published
2018-05-30 First public exploit (EDB-44806)

Exploit prediction

1.25% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-44806 Procps-ng - Multiple Vulnerabilities local, 2018-05-30
qualys.com https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	7.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD	3.0	7.0	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	4.4	AV:L/AC:M/Au:N/C:P/I:P/A:P

Affected products

[UNKNOWN] procps-ng, procps

Classification

Weakness

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

References

exploit-db.com /exploits/44806/
exploit, third-party-advisory, vdb-entry
qualys.com /2018/05/17/procps-ng-audit-report-advisory.txt
exploit, third-party-advisory
usn.ubuntu.com /3658-1/
vendor-advisory, third-party-advisory
debian.org /security/2018/dsa-4208
vendor-advisory, third-party-advisory
security.gentoo.org /glsa/201805-14
vendor-advisory, third-party-advisory
usn.ubuntu.com /3658-3/
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2019:2189
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2019-10/msg00058.html
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2019-10/msg00059.html
vendor-advisory
access.redhat.com /errata/RHSA-2020:0595
vendor-advisory
lists.debian.org /debian-lts-announce/2018/05/msg00021.html
mailing-list, third-party-advisory
securityfocus.com /bid/104214
vdb-entry, third-party-advisory
seclists.org /oss-sec/2018/q2/122
mailing-list, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=CVE-2018-1122
issue-tracking, third-party-advisory

Sources

CVE List CVE-2018-1122
NVD CVE-2018-1122

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary