CVE:CVE-2018-1124
CNNVD:CNNVD-201805-789
procps/procps-ng是一款使用在Linux平台中的用于提供proc文件系统进程信息的实用程序。
procps-ng 3.3.15之前版本中的‘file2strvec’函数存在整数溢出漏洞。本地攻击者可利用该漏洞损坏堆并提升权限，造成proc实用程序崩溃或执行任意代码。
solution:Upgrade procps-ng_project procps-ng to a higher version than 3.3.15,and avoid the version (,3.3.15); Upgrade canonical ubuntu_linux to a higher version than 14.04,16.04,17.10,18.04,and avoid the version 14.04,16.04,17.10,18.04; Upgrade debian debian_linux to a higher version than 7.0,8.0,9.0,and avoid the version 7.0,8.0,9.0; Upgrade redhat enterprise_linux to a higher version than 6.0,7.0,7.5,and avoid the version 6.0,7.0,7.5; Upgrade redhat enterprise_linux_desktop to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_server to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_workstation to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade schneider-electric struxureware_data_center_expert to a higher version than 7.6.0,and avoid the version (,7.6.0); Upgrade opensuse leap to a higher version than 15.0,15.1,and avoid the version 15.0,15.1