CVE-2019-5068: canonical ubuntu_linux Insecure Inherited Permissions
CVSS: 5.1v3.0MediumModified
AliasesSUSE-SU-2020:0111-1SUSE-SU-2020:0111-2SUSE-SU-2020:0132-1SUSE-SU-2020:0145-1SUSE-SU-2020:0146-1SUSE-SU-2021:3117-1UBUNTU-CVE-2019-5068USN-4271-1DEBIAN-CVE-2019-5068DLA-1993-1openSUSE-SU-2020:0084-1
Published 05-11-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-5068 is a medium (CVSS 5.1) Insecure Inherited Permissions vulnerability in canonical ubuntu_linux. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.1/10
010
Medium · v3.0 (CVE.org)EPSS score
0.48%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 05-11-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared memory without any specific permissions to trigger this vulnerability.
CVSS metrics
7 scores · 4 sources · 3 versionsMedium 4.4Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NSourcesAll 3 agree
- OSV · DebianEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- NVDNIST4.4MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Medium 5.1Preferred score · CVE.org (CNA)
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated5.1MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVDNIST5.1MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Low 3.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
0.00 pp
From 0.48% on 19-09-2026
19-09-202619-10-2026
EPSS score0.48%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (talosintelligence.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-277Insecure Inherited PermissionsA product defines a set of insecure permissions that are inherited by objects that are created by the program.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Suse25 products
- Mesa-drivers&distro=SUSE Linux Enterprise Desktop 12 SP4< 18.0.2-8.3.2
- Mesa-drivers&distro=SUSE Linux Enterprise Module for Basesystem 15< 18.0.2-27.6.1
- Mesa-drivers&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 18.3.2-34.9.1
- Mesa-drivers&distro=SUSE Linux Enterprise Server 12 SP4< 18.0.2-8.3.2
- Mesa-drivers&distro=SUSE Linux Enterprise Server 12 SP5< 18.3.2-14.3.2
Opensuse3 products
- leapEOL15.1
- Mesa-drivers&distro=openSUSE Leap 15.1< 18.3.2-lp151.23.9.1
- Mesa&distro=openSUSE Leap 15.1< 18.3.2-lp151.23.9.1
Debian2 products
- mesa< 19.2.6-1 | < 10.3.2-1+deb8u2
- debian_linuxEOL8.0
Canonical1 product
- ubuntu_linuxEOL18.04 | 19.10
Mesa3d1 product
- mesa19.1.2
Ubuntu1 product
- mesa< 19.2.8-0ubuntu0~18.04.2
6 vendors · 33 products
References
19 links
lists.debian.org/debian-lts-announce/2019/11/msg00013.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2020-01/msg00037.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- talosintelligence.com/vulnerability_reports/TALOS-2019-0857X Refsource MISCREPORTExploitThird Party Advisory
- lists.freedesktop.org/pipermail/mesa-dev/2019-October/223704.htmlX Refsource MISCREPORTMailing ListPatchThird Party Advisory
- gitlab.freedesktop.org/mesa/mesa/-/commit/02c3dad0f3b4d26e0faa5cc51d06bc50d693dcdcX Refsource MISCPatchThird Party Advisory
Show all 19 references
- lists.opensuse.org/archives/…Advisory