CVE-2018-1120
kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · May 18, 2018
Updated · June 30, 2026
Description
By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 2.8CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CWE-122 · Heap-based Buffer Overflow