PT-2019-14054 · Galliumos · Galliumos

Publicado 2019-08-22 · Atualizado 2020-08-24 · CVE-2019-15325

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GalliumOS version 3.0

Description The issue arises from the configuration of GalliumOS, where the CONFIG SECURITY YAMA is disabled. However, the /etc/sysctl.d/10-ptrace.conf file attempts to set the /proc/sys/kernel/yama/ptrace scope to 1. This could potentially increase risk due to the misleading appearance of a protection mechanism being in place when, in fact, it is not.

Recommendations For GalliumOS version 3.0, consider enabling CONFIG SECURITY YAMA to ensure the protection mechanism is actually in place, or adjust the /etc/sysctl.d/10-ptrace.conf file to reflect the actual security configuration, avoiding the misleading setting of /proc/sys/kernel/yama/ptrace scope to 1.

Correção

Identificadores relacionados

CVE-2019-15325

Produtos afetados

Galliumos

Referências · 4

• https://github.com/GalliumOS/galliumos-distro/issues/514 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15325 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15325 · Aviso do Fabricante
• https://kernel.org/doc/Documentation/security/Yama.txt · Nota