CVE-2018-1000001

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

CVSS v3.0

7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

13.37% chance of exploitation in the next 30 days, 96th percentile

Published

2018-01-31

Updated

2024-08-05

Proof-of-concept exploits (2)

• 0x00-0x00/CVE-2018-100000131★ · 2018-02-09
• usernameid0/tools-for-CVE-2018-10000010★ · 2022-03-28

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/glibc_realpath_priv_…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/44889
• https://www.exploit-db.com/exploits/43775

Exploit collections (1)

• helloexp/0day/tree/master/98-Linux%E6%8F%90%E6%9D%83/2018/CVE-2018-1000001

References

• CVE Record
• NVD entry

Related

• CVE-2014-6271
• CVE-2015-3224
• CVE-2016-10033
• CVE-2016-2098
• CVE-2017-5638
• CVE-2017-9805