CVE-2019-9893 - Vulnerability Details - OpenCVE

libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Libseccomp Project	Libseccomp
Redhat	Enterprise Linux

Configuration 1 [-]

cpe:2.3:a:libseccomp_project:libseccomp:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
libseccomp-0:2.4.1-1.el8	cpe:/a:redhat:enterprise_linux:8	RHSA-2019:3624	2019-11-05T00:00:00Z
libseccomp-0:2.4.1-1.el8	cpe:/o:redhat:enterprise_linux:8	RHSA-2019:3624	2019-11-05T00:00:00Z

References

Link	Providers
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00022.html
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00027.html
https://access.redhat.com/errata/RHSA-2019:3624
https://github.com/seccomp/libseccomp/issues/139
https://nvd.nist.gov/vuln/detail/CVE-2019-9893
https://seclists.org/oss-sec/2019/q1/179
https://security.gentoo.org/glsa/201904-18
https://usn.ubuntu.com/4001-1/
https://usn.ubuntu.com/4001-2/
https://www.cve.org/CVERecord?id=CVE-2019-9893

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-03-21T02:30:42

Updated: 2024-08-04T22:01:55.155Z

Reserved: 2019-03-20T00:00:00

Link: CVE-2019-9893

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-03-21T16:01:17.687

Modified: 2024-11-21T04:52:31.370

Link: CVE-2019-9893

Redhat

Severity : Moderate

Publid Date: 2019-03-14T00:00:00Z

Links: CVE-2019-9893 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-11-06T00:08:15", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/seccomp/libseccomp/issues/139"}, {"tags": ["x_refsource_MISC"], "url": "https://seclists.org/oss-sec/2019/q1/179"}, {"name": "GLSA-201904-18", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201904-18"}, {"name": "USN-4001-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4001-1/"}, {"name": "USN-4001-2", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4001-2/"}, {"name": "openSUSE-SU-2019:2283", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00022.html"}, {"name": "openSUSE-SU-2019:2280", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00027.html"}, {"name": "RHSA-2019:3624", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:3624"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-9893", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/seccomp/libseccomp/issues/139", "refsource": "MISC", "url": "https://github.com/seccomp/libseccomp/issues/139"}, {"name": "https://seclists.org/oss-sec/2019/q1/179", "refsource": "MISC", "url": "https://seclists.org/oss-sec/2019/q1/179"}, {"name": "GLSA-201904-18", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201904-18"}, {"name": "USN-4001-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4001-1/"}, {"name": "USN-4001-2", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4001-2/"}, {"name": "openSUSE-SU-2019:2283", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00022.html"}, {"name": "openSUSE-SU-2019:2280", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00027.html"}, {"name": "RHSA-2019:3624", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3624"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T22:01:55.155Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/seccomp/libseccomp/issues/139"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://seclists.org/oss-sec/2019/q1/179"}, {"name": "GLSA-201904-18", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201904-18"}, {"name": "USN-4001-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4001-1/"}, {"name": "USN-4001-2", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4001-2/"}, {"name": "openSUSE-SU-2019:2283", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00022.html"}, {"name": "openSUSE-SU-2019:2280", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00027.html"}, {"name": "RHSA-2019:3624", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:3624"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-9893", "datePublished": "2019-03-21T02:30:42", "dateReserved": "2019-03-20T00:00:00", "dateUpdated": "2024-08-04T22:01:55.155Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libseccomp_project:libseccomp:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC9691EE-D2ED-4905-8526-FD0E8043B577", "versionEndExcluding": "2.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations."}, {"lang": "es", "value": "libseccomp, en versiones anteriores a la 2.4.0, no gener\u00f3 correctamente las comparaciones del argumento syscall de 64 bits mediante los operadores aritm\u00e9ticos (LT, GT, LE, GE), lo que podr\u00eda conducir a la omisi\u00f3n de los filtros seccomp y a un potencial escalado de privilegios."}], "id": "CVE-2019-9893", "lastModified": "2024-11-21T04:52:31.370", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-03-21T16:01:17.687", "references": [{"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00022.html"}, {"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00027.html"}, {"source": "cve@mitre.org", "url": "https://access.redhat.com/errata/RHSA-2019:3624"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/seccomp/libseccomp/issues/139"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "https://seclists.org/oss-sec/2019/q1/179"}, {"source": "cve@mitre.org", "url": "https://security.gentoo.org/glsa/201904-18"}, {"source": "cve@mitre.org", "url": "https://usn.ubuntu.com/4001-1/"}, {"source": "cve@mitre.org", "url": "https://usn.ubuntu.com/4001-2/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00022.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00027.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:3624"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/seccomp/libseccomp/issues/139"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "https://seclists.org/oss-sec/2019/q1/179"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201904-18"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://usn.ubuntu.com/4001-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://usn.ubuntu.com/4001-2/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}