CVE-2018-1000001
High
CVE-2018-1000001
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
Exploit probability
13.4%
Published
January 31, 2018
Required by
Not available
Last source change
August 19, 2026
02 / AFFECTED SOFTWARE
Affected packages
1207 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Open Source Vulnerabilities
CVE-2018-1000001
View original source
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
05 / REFERENCES
Further evidence
- http://seclists.org/oss-sec/2018/q1/38
- http://www.securityfocus.com/bid/102525
- http://www.securitytracker.com/id/1040162
- https://access.redhat.com/errata/RHSA-2018:0805
- https://security.netapp.com/advisory/ntap-20190404-0003/
- https://usn.ubuntu.com/3534-1/
- https://usn.ubuntu.com/3536-1/
- https://www.exploit-db.com/exploits/43775/
- https://www.exploit-db.com/exploits/44889/
- https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/