CVE-2018-1000001
published 2018-01-31CVE-2018-1000001: In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a…
PriorityP277high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
13.37%
96.0th percentile
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | glibc | < glibc 2.26-4 (bookworm) | glibc 2.26-4 (bookworm) |
| eglibc | eglibc | >= 0 < 2.19-0ubuntu6.14 | 2.19-0ubuntu6.14 |
| gnu | glibc | <= 2.26 | — |
| gnu | glibc | >= 0 < 2.26-4 | 2.26-4 |
| gnu | glibc | >= 0 < 2.26-4 | 2.26-4 |
| gnu | glibc | >= 0 < 2.26-4 | 2.26-4 |
| gnu | glibc | >= 0 < 2.26-4 | 2.26-4 |
| gnu | glibc | >= 0 < 2.23-0ubuntu10 | 2.23-0ubuntu10 |
| musl-libc | musl | >= 0 < 0.9.15-1ubuntu0.1~esm1 | 0.9.15-1ubuntu0.1~esm1 |
| musl-libc | musl | >= 0 < 1.1.9-1ubuntu0.1~esm2 | 1.1.9-1ubuntu0.1~esm2 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | virtualization_host | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x06\x00\x00\x00\x24\x00\x00\x00\x3e\x00\x00\x00\x7f\xb9\x08\x00\x4f\x86\x09\x00
- →Detect exploit compilation or execution of RationalLove binary dropped in writable directories (e.g. /tmp). Look for hidden filenames matching random alphanumeric patterns prefixed with '.' spawned from a shell or meterpreter session. ↗
- →Monitor for unprivileged processes invoking 'umount' with an unusually large argument list including '/' repeated multiple times and 'LABEL=' strings of incrementing length — a hallmark of the RationalLove stack-spray technique. ↗
- →Alert on processes setting LC_ALL=C.UTF-8 while spawning umount with a large number of AANGUAGE= environment variables — the exploit uses 256 such variables for stack spraying. ↗
- →Detect creation of user namespaces by unprivileged users (clone_flags including CLONE_NEWUSER|CLONE_NEWNS). The exploit requires /proc/sys/kernel/unprivileged_userns_clone=1 and fails without it. ↗
- →Monitor for gcc compilation of a .c file immediately followed by chmod +x and execution of the resulting binary from /tmp or another world-writable directory — consistent with live-compile exploit delivery. ↗
- →Look for processes reading /proc/<pid>/cwd where the target pid belongs to a namespaced process, combined with subsequent realpath() calls — indicative of the exploit's CWD manipulation phase. ↗
- →Flag glibc versions matching '2.23-0ubuntu' or '2.24-11+deb9' via ldd --version output in process execution logs — these are the only versions with known working offsets in the exploit. ↗
- ·Exploitation requires unprivileged user namespaces to be enabled (kernel parameter not on by default). On RHEL 7.4 the vulnerability exists but is not exploitable with default kernel settings. ↗
- ·RHEL 6 with its default kernel is not exploitable because the kernel does not violate glibc's getcwd() assumption; containers on RHEL 6 running on a host kernel >= 2.6.36 may be vulnerable. ↗
- ·The Metasploit module only has working offsets for two specific glibc builds (2.23-0ubuntu9 and 2.24-11+deb9u1); other distributions require new offset parameters to be added to osSpecificExploitDataList. ↗
- ·A reboot is required after patching to fully apply the fix on Ubuntu systems. ↗
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vulncheck7.8HIGH
vendor_ubuntu9.8CRITICAL
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
musl vulnerabilities
vendor_ubuntu·2021-03-15·CVSS 9.8
CVE-2018-1000001 [CRITICAL] musl vulnerabilities
Title: musl vulnerabilities
Summary: Several security issues were fixed in musl.
It was discovered that musl did not properly handle kernel syscalls. An
attacker could use this vulnerability to cause a denial of service (crash)
or possibly execute arbitrary code. (CVE-2018-1000001)
It was discovered that musl did not properly handle the parsing of DNS
response codes. A remote attacker could use this vulnerability to cause
resource consumption (infinite loop), denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 14.04 ESM.
(CVE-2014-3484)
It was discovered that musl did not properly handle the parsing of DNS
response codes. A remote attacker could use this vulnerability to cause
resource consumption (infinite loop), denial of service, or possibly
execut
Ubuntu
GNU C Library vulnerability
vendor_ubuntu·2018-01-17·CVSS 7.8
CVE-2018-1000001 [HIGH] GNU C Library vulnerability
Title: GNU C Library vulnerability
Summary: The GNU C library could be made to run programs as an administrator.
It was discovered that the GNU C library did not properly handle all of
the possible return values from the kernel getcwd(2) syscall. A local
attacker could potentially exploit this to execute arbitrary code in setuid
programs and gain administrative privileges. (CVE-2018-1000001)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2018-01-17·CVSS 7.8
CVE-2017-1000408 [HIGH] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in the GNU C library.
It was discovered that the GNU C library did not properly handle all of
the possible return values from the kernel getcwd(2) syscall. A local
attacker could potentially exploit this to execute arbitrary code in setuid
programs and gain administrative privileges. (CVE-2018-1000001)
A memory leak was discovered in the _dl_init_paths() function in the GNU
C library dynamic loader. A local attacker could potentially exploit this
with a specially crafted value in the LD_HWCAP_MASK environment variable,
in combination with CVE-2017-1000409 and another vulnerability on a system
with hardlink protections disabled, in order to gain administrative
privileges. (CVE-2017-1000408)
A heap-based buf
Red Hat
glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation
vendor_redhat·2018-01-11·CVSS 7.8
CVE-2018-1000001 [HIGH] CWE-122 glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation
glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
Statement: This vulnerability affected the glibc package on Red Hat Enterprise Linux 7.4, however it can only be exploited when mount namespaces owned by user namespaces are enabled, which requires manually configuring a kernel parameter and sysctl that are not enabled by default. Please see the Bugzilla link for more details.
This vulnerability affects glibc on Red Hat Enterprise Linux 6. However the kernel included in Red Hat Enterprise Linux 6 does not violate glibc's assumption about the b
Debian
CVE-2018-1000001: glibc - In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpat...
vendor_debian·2018·CVSS 7.8
CVE-2018-1000001 [HIGH] CVE-2018-1000001: glibc - In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpat...
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
Scope: local
bookworm: resolved (fixed in 2.26-4)
bullseye: resolved (fixed in 2.26-4)
forky: resolved (fixed in 2.26-4)
sid: resolved (fixed in 2.26-4)
trixie: resolved (fixed in 2.26-4)
GHSA
GHSA-gxfx-pp2w-7f8c: In glibc 2
ghsa_unreviewed·2022-05-13
CVE-2018-1000001 [HIGH] CWE-787 GHSA-gxfx-pp2w-7f8c: In glibc 2
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
OSV
musl vulnerabilities
osv·2021-03-15·CVSS 9.8
CVE-2018-1000001 [CRITICAL] musl vulnerabilities
musl vulnerabilities
It was discovered that musl did not properly handle kernel syscalls. An
attacker could use this vulnerability to cause a denial of service (crash)
or possibly execute arbitrary code. (CVE-2018-1000001)
It was discovered that musl did not properly handle the parsing of DNS
response codes. A remote attacker could use this vulnerability to cause
resource consumption (infinite loop), denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 14.04 ESM.
(CVE-2014-3484)
It was discovered that musl did not properly handle the parsing of DNS
response codes. A remote attacker could use this vulnerability to cause
resource consumption (infinite loop), denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 16.04 ESM.
OSV
CVE-2018-1000001: In glibc 2
osv·2018-01-31·CVSS 7.8
CVE-2018-1000001 [HIGH] CVE-2018-1000001: In glibc 2
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
OSV
eglibc, glibc vulnerabilities
osv·2018-01-17·CVSS 7.8
CVE-2018-1000001 [HIGH] eglibc, glibc vulnerabilities
eglibc, glibc vulnerabilities
It was discovered that the GNU C library did not properly handle all of
the possible return values from the kernel getcwd(2) syscall. A local
attacker could potentially exploit this to execute arbitrary code in setuid
programs and gain administrative privileges. (CVE-2018-1000001)
A memory leak was discovered in the _dl_init_paths() function in the GNU
C library dynamic loader. A local attacker could potentially exploit this
with a specially crafted value in the LD_HWCAP_MASK environment variable,
in combination with CVE-2017-1000409 and another vulnerability on a system
with hardlink protections disabled, in order to gain administrative
privileges. (CVE-2017-1000408)
A heap-based buffer overflow was discovered in the _dl_init_paths()
function in the GNU C
VulnCheck
GNU GNU C Library (glibc) Out-of-bounds Write
vulncheck·2018·CVSS 7.8
CVE-2018-1000001 [HIGH] GNU GNU C Library (glibc) Out-of-bounds Write
GNU GNU C Library (glibc) Out-of-bounds Write
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
Affected: GNU GNU C Library (glibc)
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.ic3.gov/Media/News/2022/220126.pdf
Exploit PoC: https://vulncheck.com/xdb/ef732ac75768; https://vulncheck.com/xdb/79a0160329aa; https://vulncheck.com/xdb/468c0c6fe03f; https://vulncheck.com/xdb/e9ecb9b40edc; https://vulncheck.com/xdb/0b2d0c835d2b
No detection rules found.
Exploit-DB
glibc - 'realpath()' Privilege Escalation (Metasploit)
exploitdb·2018-06-13
CVE-2018-1000001 glibc - 'realpath()' Privilege Escalation (Metasploit)
glibc - 'realpath()' Privilege Escalation (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule "glibc 'realpath()' Privilege Escalation",
'Description' => %q{
This module attempts to gain root privileges on Linux systems by abusing
a vulnerability in GNU C Library (glibc) version 2.26 and prior.
This module uses halfdog's RationalLove exploit to exploit a buffer
underflow in glibc realpath() and create a SUID root shell. The exploit
has offsets for glibc versions 2.23-0ubuntu9 and 2.24-11+deb9u1.
The target system must have unprivileged user namespaces enabled.
This module has been tested successfully on Ubuntu Linux 16.04.3 (x86_64)
with glibc version 2.23-0ub
Exploit-DB
glibc < 2.26 - 'getcwd()' Local Privilege Escalation
exploitdb·2018-01-16
CVE-2018-1000001 glibc < 2.26 - 'getcwd()' Local Privilege Escalation
glibc
* See https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/ for more information.
*
* This tool exploits a buffer underflow in glibc realpath()
* and was tested against latest release from Debian, Ubuntu
* Mint. It is intended as demonstration of ASLR-aware exploitation
* techniques. It uses relative binary offsets, that may be different
* for various Linux distributions and builds. Please send me
* a patch when you developed a new set of parameters to add
* to the osSpecificExploitDataList structure and want to contribute
* them.
*
* Compile: gcc -o RationalLove RationalLove.c
* Run: ./RationalLove
*
* You may also use "--Pid" parameter, if you want to test the
* program on already existing namespaced or chrooted mounts.
*/
#define _GNU_SOURCE
#include
#include
#includ
Metasploit
glibc 'realpath()' Privilege Escalation
metasploit
glibc 'realpath()' Privilege Escalation
glibc 'realpath()' Privilege Escalation
This module attempts to gain root privileges on Linux systems by abusing a vulnerability in GNU C Library (glibc) version 2.26 and prior. This module uses halfdog's RationalLove exploit to exploit a buffer underflow in glibc realpath() and create a SUID root shell. The exploit has offsets for glibc versions 2.23-0ubuntu9 and 2.24-11+deb9u1. The target system must have unprivileged user namespaces enabled. This module has been tested successfully on Ubuntu Linux 16.04.3 (x86_64) with glibc version 2.23-0ubuntu9; and Debian 9.0 (x86_64) with glibc version 2.24-11+deb9u1.
HackerOne
Container scanning and Dependency scanning report leaked to unauthorized users
hackerone·2019-12-13·CVSS 5.0
[MEDIUM] Container scanning and Dependency scanning report leaked to unauthorized users
Container scanning and Dependency scanning report leaked to unauthorized users
Hi GitLab Security team
### Summary
GitLab makes the container scanning and dependency scanning information available as part of a JSON endpoint for merge requests. These reports are output of the CI job and should only be displayed if the visiting user has access to CI. However, right now GitLab displays the the container scanning and dependency scanning reports regardless of this permission, making it available to whoever has access to the merge request.
For public projects, GitLab allows to restrict CI pipelines to project members only (public pipelines disabled). However, in this case, the merge request widget still renders the scanning reports result, which is the outcome of a CI pipeline.
### Steps to
Bugzilla
CVE-2018-1000001 glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation [fedora-all]
bugzilla·2018-01-12·CVSS 7.8
CVE-2018-1000001 [HIGH] CVE-2018-1000001 glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation [fedora-all]
CVE-2018-1000001 glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
N
Bugzilla
CVE-2018-1000001 glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation
bugzilla·2018-01-12·CVSS 7.8
CVE-2018-1000001 [HIGH] CVE-2018-1000001 glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation
CVE-2018-1000001 glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation
A buffer underflow in realpath() in glibc when getcwd() returns relative path or unreachable path (i.e. not starting with '/') was found that can allow privilege escalation under certain conditions.
Reference:
http://www.openwall.com/lists/oss-security/2018/01/11/5
Discussion:
Acknowledgments:
Name: halfdog
---
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 1533837]
Created glibc-arm-linux-gnu tracking bugs for this issue:
Affects: fedora-all [bug 1533840]
---
There is a report of a regression related to the getcwd fix:
https://lists.gluster.org/pipermail/gluster-users/2018-January/033293.html
---
(In reply to Florian Weimer from comment
Bugzilla
CVE-2018-1000001 glibc-arm-linux-gnu: glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation [fedora-all]
bugzilla·2018-01-12·CVSS 7.8
CVE-2018-1000001 [HIGH] CVE-2018-1000001 glibc-arm-linux-gnu: glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation [fedora-all]
CVE-2018-1000001 glibc-arm-linux-gnu: glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedp
http://seclists.org/oss-sec/2018/q1/38http://www.securityfocus.com/bid/102525http://www.securitytracker.com/id/1040162https://access.redhat.com/errata/RHSA-2018:0805https://security.netapp.com/advisory/ntap-20190404-0003/https://usn.ubuntu.com/3534-1/https://usn.ubuntu.com/3536-1/https://www.exploit-db.com/exploits/43775/https://www.exploit-db.com/exploits/44889/https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/http://seclists.org/oss-sec/2018/q1/38http://www.securityfocus.com/bid/102525http://www.securitytracker.com/id/1040162https://access.redhat.com/errata/RHSA-2018:0805https://security.netapp.com/advisory/ntap-20190404-0003/https://usn.ubuntu.com/3534-1/https://usn.ubuntu.com/3536-1/https://www.exploit-db.com/exploits/43775/https://www.exploit-db.com/exploits/44889/https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/
2018-01-31
Published
Exploited in the wild