PT-2019-4976 · Seccomp+7 · Libseccomp+7

Jann Horn · Publicado 2019-03-14 · Atualizado 2024-06-15 · CVE-2019-9893

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libseccomp versions prior to 2.4.0

Description The issue is related to the incorrect generation of 64-bit syscall argument comparisons using arithmetic operators, which might allow bypassing seccomp filters and potential privilege escalations. The vulnerability is associated with insufficient access control to certain functions, potentially enabling a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2019-1495

BDU:2020-01597

CESA-2019_3624

CVE-2019-9893

MGASA-2020-0136

OPENSUSE-SU-2019:2280-1

OPENSUSE-SU-2019:2283-1

OPENSUSE-SU-2019_2280-1

OPENSUSE-SU-2019_2283-1

OPENSUSE-SU-2024:10989-1

RHSA-2019:3624

RHSA-2019_3624

SUSE-SU-2019:2517-1

SUSE-SU-2019:2941-1

SUSE-SU-2019_2517-1

SUSE-SU-2019_2941-1

USN-4001-1

USN-4001-2

Produtos afetados

Alt Linux

Astra Linux

Centos

Red Hat

Red Os

Suse

Ubuntu

Libseccomp

Referências · 50

• https://github.com/seccomp/libseccomp/issues/139 · Correção
• https://osv.dev/vulnerability/ALPINE-CVE-2019-9893 · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/NYDRQWJRBUZSB3DBB6RQ3QUB5GBSQN3T/#NYDRQWJRBUZSB3DBB6RQ3QUB5GBSQN3T · Nota
• https://suse.com/security/cve/CVE-2019-9893 · Nota
• https://bugzilla.suse.com/1128828 · Nota
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2019-3624.html · Aviso do Fabricante
• https://suse.com/support/update/announcement/2019/suse-su-20192941-1 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2019:2941-1 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-etcd-cve-2021-3711-cve-2019-9893-cve-2021-36159-cve-2022-27191 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2019:2280-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1082318 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20192517-1 · Nota
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.5 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9893 · Aviso do Fabricante