CVE-2019-11190
published 2019-04-12CVE-2019-11190: The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in…
PriorityP420medium4.7CVSS 3.0
AVLACHPRLUINSUCHINAN
EPSS
0.48%
38.5th percentile
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apparmor | apparmor | >= 0 < 2.10.95-0ubuntu2.11 | 2.10.95-0ubuntu2.11 |
| debian | linux | < linux 4.8.5-1 (bookworm) | linux 4.8.5-1 (bookworm) |
| linux | linux_kernel | < 4.8 | 4.8 |
| linux | linux_kernel | >= 0 < 4.8.5-1 | 4.8.5-1 |
| linux | linux_kernel | >= 0 < 4.8.5-1 | 4.8.5-1 |
| linux | linux_kernel | >= 0 < 4.8.5-1 | 4.8.5-1 |
| linux | linux_kernel | >= 0 < 4.8.5-1 | 4.8.5-1 |
| linux | linux_kernel | >= 0 < 4.4.0-150.176 | 4.4.0-150.176 |
CVSS provenance
nvdv3.04.7MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.7MEDIUMAV:L/AC:M/Au:N/C:C/I:N/A:N
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
vendor_ubuntu4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-553f-pjfm-rx99: The Linux kernel before 4
ghsa_unreviewed·2022-05-14
CVE-2019-11190 [MEDIUM] CWE-362 GHSA-553f-pjfm-rx99: The Linux kernel before 4
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
OSV
linux-lts-xenial, linux-aws vulnerabilities
osv·2019-06-07·CVSS 4.7
[MEDIUM] linux-lts-xenial, linux-aws vulnerabilities
linux-lts-xenial, linux-aws vulnerabilities
USN-4008-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 ESM.
Robert Święcki discovered that the Linux kernel did not properly apply
Address Space Layout Randomization (ASLR) in some situations for setuid elf
binaries. A local attacker could use this to improve the chances of
exploiting an existing vulnerability in a setuid elf binary.
(CVE-2019-11190)
It was discovered that a null pointer dereference vulnerability existed in
the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash). (CVE-2019-11810)
It was discovered that a r
OSV
apparmor update
osv·2019-06-05·CVSS 4.7
CVE-2019-11190 [MEDIUM] apparmor update
apparmor update
USN-4008-1 fixed multiple security issues in the Linux kernel. This update
provides the corresponding changes to AppArmor policy for correctly
operating under the Linux kernel with fixes for CVE-2019-11190. Without
these changes, some profile transitions may be unintentionally denied due
to missing mmap ('m') rules.
Original advisory details:
Robert Święcki discovered that the Linux kernel did not properly apply
Address Space Layout Randomization (ASLR) in some situations for setuid elf
binaries. A local attacker could use this to improve the chances of
exploiting an existing vulnerability in a setuid elf binary.
(CVE-2019-11190)
It was discovered that a null pointer dereference vulnerability existed in
the LSI Logic MegaRAID driver in the Linux kernel. A local attacker
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-06-04·CVSS 4.7
CVE-2019-11190 [MEDIUM] linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
Robert Święcki discovered that the Linux kernel did not properly apply
Address Space Layout Randomization (ASLR) in some situations for setuid elf
binaries. A local attacker could use this to improve the chances of
exploiting an existing vulnerability in a setuid elf binary.
(CVE-2019-11190)
It was discovered that a null pointer dereference vulnerability existed in
the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash). (CVE-2019-11810)
It was discovered that a race condition leading to a use-after-free existed
in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux
kernel. The RDS protocol is disabled via blocklist by de
OSV
CVE-2019-11190: The Linux kernel before 4
osv·2019-04-12·CVSS 4.7
CVE-2019-11190 [MEDIUM] CVE-2019-11190: The Linux kernel before 4
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2019-06-07·CVSS 4.7
CVE-2019-11190 [MEDIUM] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-4008-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 ESM.
Robert Święcki discovered that the Linux kernel did not properly apply
Address Space Layout Randomization (ASLR) in some situations for setuid elf
binaries. A local attacker could use this to improve the chances of
exploiting an existing vulnerability in a setuid elf binary.
(CVE-2019-11190)
It was discovered that a null pointer dereference vulnerability existed in
the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could
use this to cause a denial
Ubuntu
AppArmor update
vendor_ubuntu·2019-06-05·CVSS 4.7
CVE-2019-11190 [MEDIUM] AppArmor update
Title: AppArmor update
Summary: Several policy updates were made for running under the recently updated
Linux kernel.
USN-4008-1 fixed multiple security issues in the Linux kernel. This update
provides the corresponding changes to AppArmor policy for correctly
operating under the Linux kernel with fixes for CVE-2019-11190. Without
these changes, some profile transitions may be unintentionally denied due
to missing mmap ('m') rules.
Original advisory details:
Robert Święcki discovered that the Linux kernel did not properly apply
Address Space Layout Randomization (ASLR) in some situations for setuid elf
binaries. A local attacker could use this to improve the chances of
exploiting an existing vulnerability in a setuid elf binary.
(CVE-2019-11190)
It was discovered that a null pointer d
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-06-04·CVSS 4.7
CVE-2019-11190 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Robert Święcki discovered that the Linux kernel did not properly apply
Address Space Layout Randomization (ASLR) in some situations for setuid elf
binaries. A local attacker could use this to improve the chances of
exploiting an existing vulnerability in a setuid elf binary.
(CVE-2019-11190)
It was discovered that a null pointer dereference vulnerability existed in
the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash). (CVE-2019-11810)
It was discovered that a race condition leading to a use-after-free existed
in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux
kernel. The RDS protocol is di
Red Hat
kernel: ASLR bypass for setuid binaries due to late install_exec_creds()
vendor_redhat·2019-04-03·CVSS 4.7
CVE-2019-11190 [MEDIUM] CWE-250 kernel: ASLR bypass for setuid binaries due to late install_exec_creds()
kernel: ASLR bypass for setuid binaries due to late install_exec_creds()
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
A flaw in the load_elf_binary() function in the Linux kernel allows a local attacker to leak the base address of .text and stack sections for setuid binaries and bypass ASLR because install_exec_creds() is called too late in this function.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel-alt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red
Debian
CVE-2019-11190: linux - The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs...
vendor_debian·2019·CVSS 4.7
CVE-2019-11190 [MEDIUM] CVE-2019-11190: linux - The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs...
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
Scope: local
bookworm: resolved (fixed in 4.8.5-1)
bullseye: resolved (fixed in 4.8.5-1)
forky: resolved (fixed in 4.8.5-1)
sid: resolved (fixed in 4.8.5-1)
trixie: resolved (fixed in 4.8.5-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-11190 kernel: ASLR bypass for setuid binaries due to late install_exec_creds()
bugzilla·2019-04-15·CVSS 4.7
CVE-2019-11190 [MEDIUM] CVE-2019-11190 kernel: ASLR bypass for setuid binaries due to late install_exec_creds()
CVE-2019-11190 kernel: ASLR bypass for setuid binaries due to late install_exec_creds()
A flaw in the load_elf_binary() function in the Linux kernel allows a local attacker to leak the base address of .text and stack sections for setuid binaries and thus to bypass ASLR because install_exec_creds() is called too late in this function.
References:
https://seclists.org/oss-sec/2019/q2/9
https://www.openwall.com/lists/oss-security/2019/04/03/4
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9f834ec18defc369d73ccf9e87a2790bfa05bf46
Discussion:
Notes:
In our research we was not able to reproduce the issue with the standard RHEL-7 kernel, but only with modified kernel with specially inserted delay, which widens a race window. This means th
Bugzilla
CVE-2019-11191 kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs
bugzilla·2019-04-15·CVSS 4.7
CVE-2019-11191 [MEDIUM] CVE-2019-11191 kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs
CVE-2019-11191 kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs
The Linux kernel allows local users to bypass ASLR protection for setuid a.out programs when CONFIG_IA32_AOUT is enabled and [ia32_aout] module is loaded, because install_exec_creds() is called too late in the load_aout_binary() in fs/binfmt_aout.c. Due to this, the ptrace_may_access() check may have a race condition with install_exec_creds() when reading /proc/pid/stat file and reveal information on addresses of kernel structures, henceforth defeating the KASLR protection.
References:
https://www.openwall.com/lists/oss-security/2019/04/03/4
https://www.openwall.com/lists/oss-security/2019/04/03/4/1
Discussion:
Created kernel tracking bugs for this issue:
Affects: f
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.htmlhttp://www.openwall.com/lists/oss-security/2019/04/15/1http://www.securityfocus.com/bid/107890https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/commit/?id=a5b5352558f6808db0589644ea5401b3e3148a0dhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/commit/?id=e1676b55d874a43646e8b2c46d87f2f3e45516ffhttps://lists.debian.org/debian-lts-announce/2019/05/msg00041.htmlhttps://lists.debian.org/debian-lts-announce/2019/05/msg00042.htmlhttps://usn.ubuntu.com/4008-1/https://usn.ubuntu.com/4008-2/https://usn.ubuntu.com/4008-3/https://www.openwall.com/lists/oss-security/2019/04/03/4https://www.openwall.com/lists/oss-security/2019/04/03/4/1http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.htmlhttp://www.openwall.com/lists/oss-security/2019/04/15/1http://www.securityfocus.com/bid/107890https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/commit/?id=a5b5352558f6808db0589644ea5401b3e3148a0dhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/commit/?id=e1676b55d874a43646e8b2c46d87f2f3e45516ffhttps://lists.debian.org/debian-lts-announce/2019/05/msg00041.htmlhttps://lists.debian.org/debian-lts-announce/2019/05/msg00042.htmlhttps://usn.ubuntu.com/4008-1/https://usn.ubuntu.com/4008-2/https://usn.ubuntu.com/4008-3/https://www.openwall.com/lists/oss-security/2019/04/03/4https://www.openwall.com/lists/oss-security/2019/04/03/4/1
2019-04-12
Published