Process Hiding Vulnerability in Procps-ng by Qualys

CVE-2018-1121

What is CVE-2018-1121?

The procps-ng component, used for managing processes on Unix-like operating systems, contains a vulnerability that can be exploited to hide processes from being enumerated. By leveraging a race condition in the retrieval of process ID entries, an attacker can initiate a process with a low PID after detecting when the system is scanning the process list, effectively masking their presence from system utilities. This presents a significant security risk as it allows unprivileged users to manipulate process visibility without detection, potentially hiding malicious activities.

References