CVE-2023-4016

A heap-based buffer overflow vulnerability was found in the procps project when handling untrusted input with the -C option. This issue may allow a user with "ps" utility access to write unfiltered data into the process heap, triggering an out-of-bounds write, consuming memory and causing a crash, resulting in a denial of service.

The affected package is procps, the command line utility known as “ps” used to understand the current state of any running processes. On 32 bit systems it is possible to use specific parameters with the -C option to trigger more memory allocation than should be allowed. As this outcome is restricted to local authenticated users, a malicious user in this situation has far more powerful tools at their disposal to bring down the server, for example by simply turning it off. For this reason Red Hat Product Security rates the impact as Low.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.