CVE-2019-18276High· 7.8▾ MidnightPoC availableAn issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.6%
2 GitHub repos (last check)
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
bash <= 5.0bash = 5.0hci_management_nodeoncommand_unified_manager >= 9.5solidfirecommunications_cloud_native_core_policy = 1.14.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-3715High· 7.8A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform
CVE-2022-23219Critical· 9.8The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentia…
CVE-2022-23218Critical· 9.8The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potential…
CVE-2021-46848Critical· 9.1GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
CVE-2022-1271High· 8.8An arbitrary file write vulnerability was found in GNU gzip's zgrep utility
CVE-2022-2509High· 7.5A vulnerability found in gnutls