CVE-2019-17056

Ubuntu Security Notice USN-4184-2

Severity Score

3.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-3a359798b176.

La función llcp_sock_create en el archivo net/nfc/llcp_sock.c en el módulo de red AF_NFC en el kernel de Linux versiones hasta 5.3.2 no aplica CAP_NET_RAW, lo que significa que los usuarios no privilegiados pueden crear un socket en bruto, también se conoce como CID-3a359798b176.

USN-4184-1 fixed vulnerabilities in the Linux kernel. It was discovered that the kernel fix for CVE-2019-0155 was incomplete on 64-bit Intel x86 systems. Also, the update introduced a regression that broke KVM guests where extended page tables are disabled or not supported. This update addresses both issues. Various other issues were also addressed.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-10-01 CVE Reserved
2019-10-01 CVE Published
2024-08-05 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-276: Incorrect Default Permissions

CAPEC

References (14)

URL	Tag	Source
http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html	X_refsource_misc
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html	Mailing List
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html	Mailing List
https://seclists.org/bugtraq/2019/Nov/11	Mailing List

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0edc3f703f7bcaf550774b5d43ab727bcd0fe06b	2023-11-07

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00064.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.html	2023-11-07
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3a359798b176183ef09efb7a3dc59abad1cc7104	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JNEWGIK7QA24OIUUL67QZNJN52NB7T	2023-11-07
https://usn.ubuntu.com/4184-1	2023-11-07
https://usn.ubuntu.com/4185-1	2023-11-07
https://usn.ubuntu.com/4185-2	2023-11-07
https://usn.ubuntu.com/4186-1	2023-11-07
https://usn.ubuntu.com/4186-2	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				<= 5.3.2 Search vendor "Linux" for product "Linux Kernel" and version " <= 5.3.2"		-		Affected