PT-2019-6228 · Gnu+6 · Gnu C Library+6

Marcin Kościelnicki · Published 2019-11-19 · Updated 2024-06-15 · CVE-2019-19126

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GNU C Library versions prior to 2.31

Description The issue is related to the incorrect handling of the LD PREFER MAP 32BIT EXEC environment variable, which allows local attackers to restrict the possible mapping addresses for loaded libraries. This can lead to bypassing Address Space Layout Randomization (ASLR) for a setuid program, potentially giving attackers access to confidential data.

Recommendations For versions prior to 2.31, update to version 2.31 or later to resolve the issue. As a temporary workaround, consider disabling the use of the LD PREFER MAP 32BIT EXEC environment variable until a patch is available.

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

ALT-PU-2020-3524

BDU:2022-05763

CESA-2020_1828

CESA-2020_3861

CVE-2019-19126

DLA-3152-1

MGASA-2019-0349

OPENSUSE-SU-2024:10792-1

RHSA-2020:1828

RHSA-2020:3861

RHSA-2020_1828

RHSA-2020_3861

SUSE-SU-2020:0262-1

SUSE-SU-2020_0262-1

USN-4416-1

Affected Products

Alt Linux

Astra Linux

Centos

Gnu C Library

Red Hat

Suse

Ubuntu

References · 161

• https://nvd.nist.gov/vuln/detail/CVE-2019-19126 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18269 · Security Note
• https://usn.ubuntu.com/4416-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19126 · Vendor Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=25204 · Patch
• https://bdu.fstec.ru/vul/2021-03123 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6096 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10792-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/glibc · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/682249 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-19126 · Security Note
• https://ubuntu.com/security/CVE-2018-11237 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03566 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/695538 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11236 · Security Note