procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's
    proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use
    inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID,
    thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by
    exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng
    up to version 3.3.15, newer versions might be affected also. (CVE-2018-1121)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's     proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use     inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID,     thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by     exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng     up to version 3.3.15, newer versions might be affected also. (CVE-2018-1121)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
452021	Google: sys-process/procps: security update to 17162.279.34	Tenable Cloud Security	Google COS Security Checks	Local	medium
452021	Google: sys-process/procps: security update to 17162.279.34	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
222283	Linux Distros Unpatched Vulnerability : CVE-2018-1121	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2018-1121

medium

Tenable Plugins

medium

medium

medium