// For flags

CVE-2019-20044

zsh: insecure dropping of privileges when unsetting PRIVILEGED option

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

En Zsh versiones anteriores a 5.8, los atacantes capaces de ejecutar comandos pueden recuperar privilegios eliminados mediante la opción --no-PRIVILEGED. Zsh presenta un fallo al sobrescribir el uid guardado, ya que los privilegios originales pueden ser restaurados mediante una ejecución de zmodload de MODULE_PATH=/dir/with/module con un módulo que llama a la función setuid().

A flaw was found in zsh. When unsetting the PRIVILEGED option, the shell sets its effective user and group IDs to match their respective real IDs. When the RUID and EUID were both non-zero, it is possible to regain the shell's former privileges. Also, the setopt built-in did not correctly report errors when unsetting the option, which prevented users from handling them as the documentation recommended. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-12-27 CVE Reserved
  • 2020-02-24 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-271: Privilege Dropping / Lowering Errors
  • CWE-273: Improper Check for Dropped Privileges
CAPEC
References (22)
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zsh
Search vendor "Zsh"
Zsh
Search vendor "Zsh" for product "Zsh"
< 5.8
Search vendor "Zsh" for product "Zsh" and version " < 5.8"
-
Affected
in Apple
Search vendor "Apple"
Macos
Search vendor "Apple" for product "Macos"
--
Safe
Zsh
Search vendor "Zsh"
Zsh
Search vendor "Zsh" for product "Zsh"
< 5.8
Search vendor "Zsh" for product "Zsh" and version " < 5.8"
-
Affected
in Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
--
Safe
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
30
Search vendor "Fedoraproject" for product "Fedora" and version "30"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
31
Search vendor "Fedoraproject" for product "Fedora" and version "31"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
8.0
Search vendor "Debian" for product "Debian Linux" and version "8.0"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
9.0
Search vendor "Debian" for product "Debian Linux" and version "9.0"
-
Affected
Apple
Search vendor "Apple"
Ipados
Search vendor "Apple" for product "Ipados"
< 13.5
Search vendor "Apple" for product "Ipados" and version " < 13.5"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
< 13.5
Search vendor "Apple" for product "Iphone Os" and version " < 13.5"
-
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
< 10.15.5
Search vendor "Apple" for product "Mac Os X" and version " < 10.15.5"
-
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
>= 10.13.0 < 10.13.6
Search vendor "Apple" for product "Mac Os X" and version " >= 10.13.0 < 10.13.6"
-
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
>= 10.14.0 < 10.14.6
Search vendor "Apple" for product "Mac Os X" and version " >= 10.14.0 < 10.14.6"
-
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
>= 10.15 < 10.15.5
Search vendor "Apple" for product "Mac Os X" and version " >= 10.15 < 10.15.5"
-
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
-
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
security_update_2018-002
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
security_update_2018-003
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
security_update_2019-001
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
security_update_2019-002
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
security_update_2019-003
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
security_update_2019-004
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
security_update_2019-005
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
security_update_2019-006
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
security_update_2019-007
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
security_update_2020-001
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.13.6
Search vendor "Apple" for product "Mac Os X" and version "10.13.6"
security_update_2020-002
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.14.6
Search vendor "Apple" for product "Mac Os X" and version "10.14.6"
-
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.14.6
Search vendor "Apple" for product "Mac Os X" and version "10.14.6"
security_update_2019-001
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.14.6
Search vendor "Apple" for product "Mac Os X" and version "10.14.6"
security_update_2019-002
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.14.6
Search vendor "Apple" for product "Mac Os X" and version "10.14.6"
security_update_2019-004
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.14.6
Search vendor "Apple" for product "Mac Os X" and version "10.14.6"
security_update_2019-005
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.14.6
Search vendor "Apple" for product "Mac Os X" and version "10.14.6"
security_update_2019-006
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.14.6
Search vendor "Apple" for product "Mac Os X" and version "10.14.6"
security_update_2019-007
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.14.6
Search vendor "Apple" for product "Mac Os X" and version "10.14.6"
security_update_2020-001
Affected
Apple
Search vendor "Apple"
Mac Os X
Search vendor "Apple" for product "Mac Os X"
10.14.6
Search vendor "Apple" for product "Mac Os X" and version "10.14.6"
security_update_2020-002
Affected
Apple
Search vendor "Apple"
Tvos
Search vendor "Apple" for product "Tvos"
< 13.4.5
Search vendor "Apple" for product "Tvos" and version " < 13.4.5"
-
Affected
Apple
Search vendor "Apple"
Watchos
Search vendor "Apple" for product "Watchos"
< 6.2.5
Search vendor "Apple" for product "Watchos" and version " < 6.2.5"
-
Affected