cbcvebase.
CVE-2019-18276
published 2019-11-28

CVE-2019-18276: An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its…

PriorityP344high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
2.61%
83.7th percentile
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Affected

12 ranges
VendorProductVersion rangeFixed in
debianbash< bash 5.1~rc1-2 (bookworm)bash 5.1~rc1-2 (bookworm)
gnubash<= 5.0
gnubash
gnubash>= 0 < 5.1~rc1-25.1~rc1-2
gnubash>= 0 < 5.1~rc1-25.1~rc1-2
gnubash>= 0 < 5.1~rc1-25.1~rc1-2
gnubash>= 0 < 5.1~rc1-25.1~rc1-2
msrccbl_mariner_1.0_arm
msrccbl_mariner_1.0_x64
msrccm1_bash_4.4.18-6_on_cbl_mariner_1.0
netapponcommand_unified_manager>= 9.5
oraclecommunications_cloud_native_core_policy

Detection & IOCsextracted from sources · hover to see the quote

commandenable -f
  • Monitor for use of the bash 'enable -f' builtin command, which can be used to load a shared object (.so) at runtime to call setuid() and regain dropped privileges.
  • Focus detection on bash processes running as non-root where effective UID differs from real UID (setuid bash binaries owned by non-root users), as binaries running with effective UID of 0 are unaffected.
  • Look for bash processes loading external shared objects via 'enable -f' without a subsequent exec() call, as exploitation requires setuid() to be called without exec()-ing another process (which would lose the saved UID).
  • Audit for bash binaries with the setuid bit set owned by non-root users, as this is the prerequisite condition for exploitation.
  • The vulnerable code path is in disable_priv_mode() in shell.c; on affected systems, the saved UID is not dropped because setuid() is used instead of setresuid(). Patch reference commit is 951bdaad7a18cc0dc1036bba86b18b90874d39ff on the devel branch.
  • ·Vulnerability only affects GNU Bash through version 5.0 patch 11; fixed in 5.1~rc1-2 (Debian) and addressed in RHEL 8 via RHSA-2021:1679. Verify bash version before triaging alerts.
  • ·Exploitation requires a non-root setuid bash binary AND an attacker already having command execution in the shell — this is not a remote exploit (CVSS scope is local).
  • ·The saved UID privilege retention only applies on Linux and other systems supporting 'saved UID' functionality; behavior may differ on other platforms.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8LOW
vendor_msrc7.8HIGH
vendor_oracle7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.