PT-2019-4755 · Linux+1 · Linux Kernel+1

Jann Horn · Published 2019-11-12 · Updated 2020-05-01 · CVE-2019-15793

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.0 through 5.3

Description The issue is related to the shiftfs component of the Linux kernel, which has inadequate access control. This could allow an attacker to elevate their privileges. A local attacker may exploit this to bypass discretionary access control permissions due to incorrect translation of user and group IDs in the lower filesystem. The IDs were being translated into init user ns instead of the intended s user ns for the lower filesystem, potentially leading to the use of unintended IDs.

Recommendations For Linux kernel versions 5.0 through 5.3, consider applying a patch that corrects the translation of user and group IDs to the proper namespace for the lower filesystem. As a temporary workaround, restrict access to sensitive areas of the filesystem to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Weakness Enumeration

CWE-276

CWE-538

CWE-264

Related Identifiers

BDU:2020-01327

CVE-2019-15793

USN-4183-1

USN-4184-1

Affected Products

Linux Kernel

Ubuntu

References · 31

• 🔥 https://exploit-db.com/exploits/47693 · Exploit
• https://ubuntu.com/security/CVE-2019-15793 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11135 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12207 · Vendor Advisory
• https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=3644b9d5688da86f18e017c9c580b75cf52927bb · Patch
• https://ubuntu.com/security/CVE-2019-15098 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-15793 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-15793 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20241206SE81 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4184-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17054 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15793 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01327 · Security Note
• https://ubuntu.com/security/CVE-2019-17053 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4184-1 · Vendor Advisory