CVE-2019-19126

Advisory lineage Upstream: 0 Downstream: 9
Modified
Published: 19 Nov 2019, 00:00
Last modified:05 Aug 2024, 02:09

Vulnerability Summary

Overall Risk (default)
low
13/100
CVSS Score
3.3 LOW
v3.1 (nvd)
EPSS Score
0.01% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Nov 2019, 00:00
Published
Vulnerability first disclosed
05 Aug 2024, 02:09
Last Modified
Vulnerability information updated

Description

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

CVSS Metrics

  • v3.1•LOW•Score: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • v2.0•LOW•Score: 2.1AV:L/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.01%• Percentile: 3%

Techniques & Countermeasures

  • CWE-665•Improper Initialization

    The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

Affected Systems

  • canonical•ubuntu_linux

    16.04 | 18.04 | 19.10

  • debian•debian_linux

    10.0

  • fedoraproject•fedora

    30 | 31

  • gnu•glibc

    < 2.31

References (5)