PT-2021-19404 · Debian · Xscreensaver

Tavis Ormandy · Published 2021-04-21 · Updated 2021-04-29 · CVE-2021-31523

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Debian xscreensaver version 5.42+dfsg1-1

Description The issue arises from the Debian xscreensaver package having the cap net raw capability enabled for the /usr/libexec/xscreensaver/sonar file. This setting can be exploited by local users to gain privileges, potentially due to incompatibility with the design of the Mesa 3D Graphics library dependency.

Recommendations For Debian xscreensaver version 5.42+dfsg1-1, consider disabling the cap net raw capability for the /usr/libexec/xscreensaver/sonar file as a temporary workaround to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-31523

Affected Products

Xscreensaver

References · 10

• https://cve.org/CVERecord?id=CVE-2021-31523 · Security Note
• https://ubuntu.com/security/CVE-2021-31523 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-31523 · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/04/21/3 · Patch
• https://openwall.com/lists/oss-security/2021/04/17/1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-31523 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-31523 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31523 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-31523 · Vendor Advisory
• https://bugs.chromium.org/p/project-zero/issues/detail?id=2174 · Note