PT-2019-4751 · Linux+3 · Linux Kernel+3

Ori Nimron

·

Published

2019-09-24

·

Updated

2021-05-28

·

CVE-2019-17054

CVSS v3.1

3.3

Low

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Linux kernel versions through 5.3.2
Description The issue is related to the atalk create function in the AF APPLETALK network module, which does not enforce the CAP NET RAW capability. This means that unprivileged users can create a raw socket. The vulnerability is associated with a lack of standard permission mechanisms, which could allow an attacker to impact data integrity.
Recommendations For Linux kernel versions through 5.3.2, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-276

Related Identifiers

ALT-PU-2019-2838
ALT-PU-2019-2845
ALT-PU-2019-2891
ALT-PU-2020-1198
ALT-PU-2020-1501
ALT-PU-2020-1714
ALT-PU-2020-2410
ALT-PU-2020-2433
ALT-PU-2021-1870
BDU:2020-01323
CVE-2019-17054
DLA-2068-1
DLA-2114-1
SUSE-SU-2019:14218-1
SUSE-SU-2019_14218-1
USN-4184-1
USN-4185-1
USN-4185-2
USN-4186-1
USN-4186-2

Affected Products

Alt Linux
Linux Kernel
Suse
Ubuntu