PT-2019-4749 · Linux+3 · Linux Kernel+3

Ori Nimron

·

Publicado

2019-09-24

·

Atualizado

2022-10-07

·

CVE-2019-17052

CVSS v3.1

3.3

Baixa

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.16 through 5.3.2
Description The issue is related to the ax25 create function in the AF AX25 network module, which does not properly enforce the CAP NET RAW capability. This allows unprivileged users to create a raw socket, potentially compromising data integrity.
Recommendations For Linux kernel versions 3.16 through 5.3.2, consider restricting access to the ax25 create function until a patch is available. As a temporary workaround, limiting the creation of raw sockets for unprivileged users may help minimize the risk of exploitation.

Correção

Incorrect Default Permissions

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

ALT-PU-2019-2838
ALT-PU-2019-2845
ALT-PU-2019-2891
ALT-PU-2020-1198
ALT-PU-2020-1501
ALT-PU-2020-1714
ALT-PU-2020-2410
ALT-PU-2020-2433
ALT-PU-2021-1870
BDU:2020-01321
CVE-2019-17052
DLA-2068-1
DLA-2114-1
SUSE-SU-2019:14218-1
SUSE-SU-2019_14218-1
USN-4184-1
USN-4185-1
USN-4185-2
USN-4186-1
USN-4186-2

Produtos afetados

Alt Linux
Linux Kernel
Suse
Ubuntu