CVE-2018-1000001 EXPLOIT
7.8
HIGH · CVSS 3.0 · EPSS 13.4% (pctl 96)
Patch early
A public exploit exists.
Description
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
Scoring
| CVSS | 7.8 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 13.37% — more likely to be exploited than 96% of all CVEs |
| Weakness | CWE-787 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2018-01-31 |
| Last modified | 2026-06-17 |
Affected (9)
| Vendor | Product |
|---|---|
| canonical | ubuntu linux |
| gnu | glibc |
| redhat | enterprise linux desktop |
| redhat | enterprise linux server |
| redhat | enterprise linux server aus |
| redhat | enterprise linux server eus |
| redhat | enterprise linux server tus |
| redhat | enterprise linux workstation |
| redhat | virtualization host |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | glibc - 'realpath()' Privilege Escalation (Metasploit) | 2018-06-13 |
| exploit-db | glibc < 2.26 - 'getcwd()' Local Privilege Escalation | 2018-01-16 |
References
- http://seclists.org/oss-sec/2018/q1/38
- http://www.securityfocus.com/bid/102525
- http://www.securitytracker.com/id/1040162
- https://access.redhat.com/errata/RHSA-2018:0805
- https://security.netapp.com/advisory/ntap-20190404-0003/
- https://usn.ubuntu.com/3534-1/
- https://usn.ubuntu.com/3536-1/
- https://www.exploit-db.com/exploits/43775/
- https://www.exploit-db.com/exploits/44889/
- https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/
- http://seclists.org/oss-sec/2018/q1/38
- http://www.securityfocus.com/bid/102525
- http://www.securitytracker.com/id/1040162
- https://access.redhat.com/errata/RHSA-2018:0805
- https://security.netapp.com/advisory/ntap-20190404-0003/
- https://usn.ubuntu.com/3534-1/
- https://usn.ubuntu.com/3536-1/
- https://www.exploit-db.com/exploits/43775/
- https://www.exploit-db.com/exploits/44889/
- https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/
→ the Explorer · watch your stack · NVD