Vulnerability in GNU Bash
CVE-2019-18276
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.026 (84.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 84.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.026 · newest: 0.026 · change: 0.000
Affected products
- GNU Bash — versions 5.0
- NetApp Hci Management Node
- NetApp Oncommand Unified Manager
- NetApp Solidfire
- Oracle Communications Cloud Native Core Policy — versions 1.14.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac… (mailing-list)
- security.gentoo.org/glsa/202105-34 (vendor-advisory, Third Party Advisory)
- www.oracle.com/security-alerts/cpuapr2022.html (Patch, Third Party Advisory)
- www.youtube.com/watch (Exploit, Third Party Advisory)
- github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff (Patch, Third Party Advisory)
- packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html (Exploit, VDB Entry, Third Party Advisory)
- security.netapp.com/advisory/ntap-20200430-0003/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2019-18276?
- CVE-2019-18276 is a high-severity vulnerability in GNU Bash, classified under Improper Check for Dropped Privileges. CVSS score: 7.8/10. Published 2019-11-28.
- How severe is CVE-2019-18276?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2019-18276 known to be exploited?
- 19 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.