CVE-2019-20044 — Improper Check for Dropped Privileges in Apple Ipados

CWE-273 — Improper Check for Dropped PrivilegesCWE-271 — Privilege Dropping / Lowering Errors9 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 79.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
ZSHApple IpadosApple Iphone OS+6 more
Timeline
PublishedFeb 24
Latest updateMay 24

Description

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages9 packages

▶NVDzsh/zsh< 5.8
▶NVDapple/tvos< 13.4.5
▶debiandebian/zsh< zsh 5.8-1 (bookworm)
▶NVDapple/ipados< 13.5
▶NVDapple/watchos< 6.2.5

Also affects: Debian Linux 8.0, 9.0, Fedora 30, 31

🔴Vulnerability Details

3
GHSA
GHSA-gwf9-995r-26hx: In Zsh before 5↗2022-05-24
▶
OSV
zsh vulnerabilities↗2022-03-14
▶
OSV
CVE-2019-20044: In Zsh before 5↗2020-02-24
▶

📋Vendor Advisories

3
Ubuntu
Zsh vulnerabilities↗2022-03-14
▶
Red Hat
zsh: insecure dropping of privileges when unsetting PRIVILEGED option↗2020-02-16
▶
Debian
CVE-2019-20044: zsh - In Zsh before 5.8, attackers able to execute commands can regain privileges drop...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-20044 zsh: insecure dropping of privileges when unsetting PRIVILEGED option↗2020-02-19
▶
Bugzilla
CVE-2019-20044 zsh: insecure dropping of privileges when unsetting PRIVILEGED option [fedora-all]↗2020-02-19
▶