CVE-2019-17055 — Missing Authorization in Kernel

CWE-862 — Missing AuthorizationCWE-250 — Execution with Unnecessary PrivilegesCWE-20 — Improper Input Validation13 documents8 sources
Severity
3.3LOWNVD
EPSS
0.1%
top 74.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Linux KernelCanonical Ubuntu LinuxDebian Linux+5 more
Timeline
PublishedOct 1
Latest updateMay 24

Description

base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages6 packages

▶Debianlinux/linux_kernel< 5.3.7-1+3

Also affects: Debian Linux 8.0, Ubuntu Linux 14.04, 16.04, 18.04, 19.04, Fedora 29

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-c629-jm42-84f5: base_sock_create in drivers/isdn/mISDN/socket↗2022-05-24
▶
CVEList
CVE-2019-17055: base_sock_create in drivers/isdn/mISDN/socket↗2019-10-01
▶
OSV
CVE-2019-17055: base_sock_create in drivers/isdn/mISDN/socket↗2019-10-01
▶

📋Vendor Advisories

7
Ubuntu
Linux kernel vulnerabilities↗2019-11-13
▶
Ubuntu
Linux kernel vulnerabilities↗2019-11-13
▶
Ubuntu
Linux kernel vulnerabilities↗2019-11-13
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2019-11-13
▶
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities↗2019-11-13
▶

💬Community

2
Bugzilla
CVE-2019-17055 kernel: privilege escalation in base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module [fedora-all]↗2019-10-03
▶
Bugzilla
CVE-2019-17055 kernel: unprivileged users able to create RAW sockets in AF_ISDN network protocol↗2019-10-03
▶
CVE-2019-17055 — Missing Authorization in Linux Kernel | cvebase