Information disclosure in Netapp Storage Automation Store

CVE-2018-10545

An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.

Vulnerability class: Information Disclosure

EPSS: 0.008 (53.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

  • cve@mitre.org (x_refsource_CONFIRM, Patch, Issue Tracking, Vendor Advisory)
  • cve@mitre.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
  • cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
  • cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
  • cve@mitre.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
  • cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
  • cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
  • cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
  • cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)

Frequently asked questions

What is CVE-2018-10545?
CVE-2018-10545 is a medium-severity vulnerability in Netapp Storage Automation Store, classified under Information Disclosure. CVSS score: 4.7/10. Published 2018-04-29.
How severe is CVE-2018-10545?
Medium severity. CVSS v3 base score is 4.7 out of 10.
Is CVE-2018-10545 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.