CVE-2019-18276
published 2019-11-28CVE-2019-18276: An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its…
PriorityP344high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
2.61%
83.7th percentile
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | bash | < bash 5.1~rc1-2 (bookworm) | bash 5.1~rc1-2 (bookworm) |
| gnu | bash | <= 5.0 | — |
| gnu | bash | — | — |
| gnu | bash | >= 0 < 5.1~rc1-2 | 5.1~rc1-2 |
| gnu | bash | >= 0 < 5.1~rc1-2 | 5.1~rc1-2 |
| gnu | bash | >= 0 < 5.1~rc1-2 | 5.1~rc1-2 |
| gnu | bash | >= 0 < 5.1~rc1-2 | 5.1~rc1-2 |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_bash_4.4.18-6_on_cbl_mariner_1.0 | — | — |
| netapp | oncommand_unified_manager | >= 9.5 | — |
| oracle | communications_cloud_native_core_policy | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for use of the bash 'enable -f' builtin command, which can be used to load a shared object (.so) at runtime to call setuid() and regain dropped privileges. ↗
- →Focus detection on bash processes running as non-root where effective UID differs from real UID (setuid bash binaries owned by non-root users), as binaries running with effective UID of 0 are unaffected. ↗
- →Look for bash processes loading external shared objects via 'enable -f' without a subsequent exec() call, as exploitation requires setuid() to be called without exec()-ing another process (which would lose the saved UID). ↗
- →Audit for bash binaries with the setuid bit set owned by non-root users, as this is the prerequisite condition for exploitation. ↗
- →The vulnerable code path is in disable_priv_mode() in shell.c; on affected systems, the saved UID is not dropped because setuid() is used instead of setresuid(). Patch reference commit is 951bdaad7a18cc0dc1036bba86b18b90874d39ff on the devel branch. ↗
- ·Vulnerability only affects GNU Bash through version 5.0 patch 11; fixed in 5.1~rc1-2 (Debian) and addressed in RHEL 8 via RHSA-2021:1679. Verify bash version before triaging alerts. ↗
- ·Exploitation requires a non-root setuid bash binary AND an attacker already having command execution in the shell — this is not a remote exploit (CVSS scope is local). ↗
- ·The saved UID privilege retention only applies on Linux and other systems supporting 'saved UID' functionality; behavior may differ on other platforms. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8LOW
vendor_msrc7.8HIGH
vendor_oracle7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Rockwell Automation DataMosaix Private Cloud
cisa_ics·2024-10-10·CVSS 7.5
[HIGH] Rockwell Automation DataMosaix Private Cloud
ICS Advisory
##
Rockwell Automation DataMosaix Private Cloud
Release DateOctober 10, 2024
Alert CodeICSA-24-284-16
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.3
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Rockwell Automation
- Equipment: DataMosaix Private Cloud
- Vulnerabilities: Inadequate Encryption Strength, Out-of-bounds Write, Improper Check for Dropped Privileges, Reliance on Insufficiently Trustworthy Component, NULL Pointer Dereference
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could cause a denial-of-service condition, view user data, or perform remote code execution.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTE
Ubuntu
Bash vulnerability
vendor_ubuntu·2022-04-20
CVE-2019-18276 Bash vulnerability
Title: Bash vulnerability
Summary: Bash could be used to escalate privileges.
It was discovered that Bash did not properly drop privileges
when the binary had the setuid bit enabled. An attacker could
possibly use this issue to escalate privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Communications Risk Matrix: Policy (GNU Bash) — CVE-2019-18276
vendor_oracle·2022-04-15·CVSS 7.8
CVE-2019-18276 [HIGH] Oracle Oracle Communications Risk Matrix: Policy (GNU Bash) — CVE-2019-18276
Oracle Oracle Communications Risk Matrix: Policy (GNU Bash) vulnerability
CVE: CVE-2019-18276
CVSS: 7.8
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuapr2022 (APR 2022)
Microsoft
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default if Bash is run with its effective UID not equal to its real UID it will drop privileges by setting
vendor_msrc·2019-11-12·CVSS 7.8
CVE-2019-18276 [HIGH] CWE-273 An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default if Bash is run with its effective UID not equal to its real UID it will drop privileges by setting
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default if Bash is run with its effective UID not equal to its real UID it will drop privileges by setting its effective UID to its real UID. However it does so incorrectly. On Linux and other systems that support "saved UID" functionality the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin which can be a shared object that calls setuid() and therefore regains privileges. However binaries running with an effective UID of 0 are unaffected.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our c
Red Hat
bash: when effective UID is not equal to its real UID the saved UID is not dropped
vendor_redhat·2019-07-01·CVSS 7.8
CVE-2019-18276 [HIGH] CWE-271 bash: when effective UID is not equal to its real UID the saved UID is not dropped
bash: when effective UID is not equal to its real UID the saved UID is not dropped
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
A privilege escalation vulnerability was found in bash in the way it dropped privileges wh
Debian
CVE-2019-18276: bash - An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 ...
vendor_debian·2019·CVSS 7.8
CVE-2019-18276 [HIGH] CVE-2019-18276: bash - An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 ...
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
Scope: local
bookworm: resolved (fixed in 5.1~rc1-2)
bullseye: resolved (fixed in 5.1~rc1-2)
forky: resolved (fixed in 5.1~rc1-2)
sid: resolved (fixed in 5.1~rc1-2)
trixie: re
GHSA
GHSA-jcxc-5f87-vq5m: An issue was discovered in disable_priv_mode in shell
ghsa_unreviewed·2022-05-24
CVE-2019-18276 [HIGH] CWE-273 GHSA-jcxc-5f87-vq5m: An issue was discovered in disable_priv_mode in shell
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
OSV
CVE-2019-18276: An issue was discovered in disable_priv_mode in shell
osv·2019-11-28·CVSS 7.8
CVE-2019-18276 [HIGH] CVE-2019-18276: An issue was discovered in disable_priv_mode in shell
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-18276 bash: when effective UID is not equal to its real UID the saved UID is not dropped
bugzilla·2019-11-29·CVSS 7.8
CVE-2019-18276 [HIGH] CVE-2019-18276 bash: when effective UID is not equal to its real UID the saved UID is not dropped
CVE-2019-18276 bash: when effective UID is not equal to its real UID the saved UID is not dropped
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
Reference and upstream commit:
https://git.savannah.gnu.org/cgit/bash.git/c
Bugzilla
CVE-2019-18276 bash: when effective UID is not equal to its real UID the saved UID is not dropped [fedora-all]
bugzilla·2019-11-29·CVSS 7.8
CVE-2019-18276 [HIGH] CVE-2019-18276 bash: when effective UID is not equal to its real UID the saved UID is not dropped [fedora-all]
CVE-2019-18276 bash: when effective UID is not equal to its real UID the saved UID is not dropped [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue af
Wiz
What Is DevOps Security? Implement, Challenges, Best Practices | Wiz
blogs_wiz·2024-12-02
What Is DevOps Security? Implement, Challenges, Best Practices | Wiz
## What is DevOps security?
DevOps security integrates security practices within the DevOps process from inception through development, deployment, and operations. It breaks down traditional silos between development, operations, and security teams, promoting a culture of security across all phases of the software development lifecycle (SDLC).
- In its early stages, DevOps focused primarily on integrating development and operations teams to improve the software development process.
- Over time, the scope of DevOps expanded to include security (especially when it comes to cloud platforms like AWS, Azure, and Google Cloud), giving rise to the term "DevSecOps."
- This integration marks a significant paradigm shift, emphasizing a comprehensive approach where security measures, championed by
http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.htmlhttps://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ffhttps://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3Ehttps://security.gentoo.org/glsa/202105-34https://security.netapp.com/advisory/ntap-20200430-0003/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.youtube.com/watch?v=-wGtxJ8opa8http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.htmlhttps://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ffhttps://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3Ehttps://security.gentoo.org/glsa/202105-34https://security.netapp.com/advisory/ntap-20200430-0003/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.youtube.com/watch?v=-wGtxJ8opa8
2019-11-28
Published