CVE-2019-19126 — Improper Initialization in Glibc

CWE-665 — Improper InitializationCWE-20 — Improper Input ValidationCWE-200 — Sensitive Information Exposure11 documents9 sources
Severity
3.3LOWNVD
EPSS
0.0%
top 93.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
GNU GlibcCanonical Ubuntu LinuxDebian Linux+1 more
Timeline
PublishedNov 19
Latest updateMay 24

Description

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages2 packages

▶NVDgnu/glibc< 2.31
▶Debiangnu/glibc< 2.29-8+3

Also affects: Debian Linux 10.0, Fedora 30, 31, Ubuntu Linux 16.04, 18.04, 19.10

Patches

Patch: sourceware.org ↗Patch: sourceware.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-p4p6-gwhq-q5q7: On the x86-64 architecture, the GNU C Library (aka glibc) before 2↗2022-05-24
▶
CVEList
CVE-2019-19126: On the x86-64 architecture, the GNU C Library (aka glibc) before 2↗2019-11-19
▶
OSV
CVE-2019-19126: On the x86-64 architecture, the GNU C Library (aka glibc) before 2↗2019-11-19
▶

📋Vendor Advisories

4
Ubuntu
GNU C Library vulnerabilities↗2020-07-06
▶
Red Hat
glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries↗2019-11-19
▶
Microsoft
On the x86-64 architecture the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition allowing loc↗2019-11-12
▶
Debian
CVE-2019-19126: glibc - On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to i...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-19126 glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries↗2019-11-20
▶
Bugzilla
CVE-2019-19126 glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries [fedora-all]↗2019-11-20
▶
Bugzilla
CVE-2019-19126 glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries [fedora-all]↗2019-11-20
▶
CVE-2019-19126 — Improper Initialization in GNU Glibc | cvebase