CVE-2019-17052 — Incorrect Default Permissions in Linux

CWE-276 — Incorrect Default PermissionsCWE-250 — Execution with Unnecessary Privileges23 documents7 sources
Severity
3.3LOWNVD
OSV6.5
EPSS
0.1%
top 75.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Linux KernelDebian LinuxCanonical Ubuntu Linux+2 more
Timeline
PublishedOct 1
Latest updateMay 24

Description

ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-0614e2b73768.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages4 packages

▶Debianlinux/linux_kernel< 5.3.7-1+3
▶Ubuntulinux/linux_kernel< 4.4.0-168.197+3
▶NVDlinux/linux_kernel3.16 — 5.3.2
▶debiandebian/linux< linux 5.3.7-1 (bookworm)

Also affects: Debian Linux 8.0, Ubuntu Linux 14.04, 16.04, 18.04, 19.04, Fedora 29

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

10
GHSA
GHSA-wr2q-2frg-76q3: ax25_create in net/ax25/af_ax25↗2022-05-24
▶
OSV
linux, linux-aws, linux-kvm vulnerabilities↗2019-11-13
▶
OSV
linux vulnerability↗2019-11-13
▶
OSV
linux-lts-xenial, linux-aws vulnerabilities↗2019-11-13
▶
OSV
linux, linux-hwe, linux-oem-osp1 vulnerability and regression↗2019-11-13
▶

📋Vendor Advisories

10
Ubuntu
Linux kernel vulnerabilities↗2019-11-13
▶
Ubuntu
Linux kernel vulnerability and regression↗2019-11-13
▶
Ubuntu
Linux kernel vulnerability and regression↗2019-11-13
▶
Ubuntu
Linux kernel vulnerabilities↗2019-11-13
▶
Ubuntu
Linux kernel vulnerability↗2019-11-13
▶

💬Community

2
Bugzilla
CVE-2019-17052 kernel: unprivileged users able to create RAW sockets in the the AF_AX25 network protocol.↗2019-10-03
▶
Bugzilla
CVE-2019-17052 kernel: priviledge escalation in ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module [fedora-all]↗2019-10-03
▶