CVE-2019-11190: Race Condition
A flaw in the loadelfbinary() function in the Linux kernel allows a local attacker to leak the base address of .text and stack sections for setuid binaries and bypass ASLR because installexeccreds() is called too late in this function.
Other sources
A flaw in the loadelfbinary() function in the Linux kernel allows a local attacker to leak the base address of .text and stack sections for setuid binaries and thus to bypass ASLR because installexeccreds() is called too late in this function.
References:
https://seclists.org/oss-sec/2019/q2/9
https://www.openwall.com/lists/oss-security/2019/04/03/4
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9f834ec18defc369d73ccf9e87a2790bfa05bf46
— Red Hat
Linux Kernel could allow a local attacker to bypass security restrictions, caused by a race condition when reading /proc/pid/stat. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass ASLR on setuid programs.
— IBM
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because installexeccreds() is called too late in loadelfbinary() in fs/binfmtelf.c, and thus the ptracemayaccess() check has a race condition when reading /proc/pid/stat.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1127.rt56.1093.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1127.el7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.1.177-1Fixed in 6.12.94-1Fixed in 6.12.95-1Fixed in 7.1.3-1Fixed in 7.1.4-1 - Upgrade
Upgrade
linux kernel (fs/binfmt_elf.c: load_elf_binary)to a version that resolves this vulnerability.Fixed in 4.8 - Compensating control
Mitigate by restricting local unprivileged access to setuid binaries (e.g., reduce who can execute/obtain access to setuid programs like /bin/su) until the kernel is upgraded to 4.8 or later.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-11190?
CVE-2019-11190 is a vulnerability in the Linux kernel that allows a local attacker to bypass ASLR on setuid programs.
How severe is CVE-2019-11190?
CVE-2019-11190 has a severity level of low.
How can I fix CVE-2019-11190?
To fix CVE-2019-11190, it is recommended to update your Linux kernel to version 4.8 or higher.
What versions of Linux are affected by CVE-2019-11190?
Linux versions before 4.8 are affected by CVE-2019-11190.
Where can I find more information about CVE-2019-11190?
You can find more information about CVE-2019-11190 at the following references: [link1] [link2] [link3].