Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-1000001Out-of-bounds Write in Glibc

Severity
7.8HIGHNVD
OSV9.8
EPSS
41.4%
top 2.59%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Timeline
PublishedJan 31
Latest updateMay 13

Description

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages9 packages

Debiangnu/glibc< 2.26-4+3
Ubuntugnu/glibc< 2.23-0ubuntu10
Ubuntueglibc/eglibc< 2.19-0ubuntu6.14
NVDgnu/glibc2.26
Ubuntumusl-libc/musl< 0.9.15-1ubuntu0.1~esm1+1

Also affects: Ubuntu Linux 12.04, 14.04, 16.04, 17.10, Enterprise Linux 7.6

🔴Vulnerability Details

6
GHSA
GHSA-gxfx-pp2w-7f8c: In glibc 22022-05-13
OSV
musl vulnerabilities2021-03-15
CVEList
CVE-2018-1000001: In glibc 22018-01-31
OSV
CVE-2018-1000001: In glibc 22018-01-31
OSV
eglibc, glibc vulnerabilities2018-01-17

💥Exploits & PoCs

2
Exploit-DB
glibc - 'realpath()' Privilege Escalation (Metasploit)2018-06-13
Exploit-DB
glibc < 2.26 - 'getcwd()' Local Privilege Escalation2018-01-16

📋Vendor Advisories

5
Ubuntu
musl vulnerabilities2021-03-15
Ubuntu
GNU C Library vulnerability2018-01-17
Ubuntu
GNU C Library vulnerabilities2018-01-17
Red Hat
glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation2018-01-11
Debian
CVE-2018-1000001: glibc - In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpat...2018

💬Community

3
Bugzilla
CVE-2018-1000001 glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation [fedora-all]2018-01-12
Bugzilla
CVE-2018-1000001 glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation2018-01-12
Bugzilla
CVE-2018-1000001 glibc-arm-linux-gnu: glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation [fedora-all]2018-01-12
CVE-2018-1000001 — Out-of-bounds Write in GNU Glibc | cvebase