CVE-2018-1000001

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

CVSS v3.0 NVD

7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

13.37% chance of exploitation in the next 30 days, 96th percentile

Published

2018-01-31

Updated

2024-08-05

Proof-of-concept exploits (2)

• 0x00-0x00/CVE-2018-100000131★ · 2018-02-09
• usernameid0/tools-for-CVE-2018-10000010★ · 2022-03-28

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/glibc_realpath_priv_…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/44889
• https://www.exploit-db.com/exploits/43775

Exploit collections (1)

• CVE-2018-1000001helloexp/0day

Security advisories

• http://seclists.org/oss-sec/2018/q1/38
• http://www.securityfocus.com/bid/102525
• http://www.securitytracker.com/id/1040162
• https://access.redhat.com/errata/RHSA-2018:0805
• https://usn.ubuntu.com/3534-1
• https://usn.ubuntu.com/3536-1
• https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow

References

• CVE Record
• NVD entry

Related

• CVE-2014-6271
• CVE-2015-3224
• CVE-2016-10033
• CVE-2016-2098
• CVE-2017-5638
• CVE-2017-9805