CVE-2019-11191

Published: 11 April 2019

** DISPUTED ** The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass ASLR on setuid a.out programs (if any exist) because install_exec_creds() is called too late in load_aout_binary() in fs/binfmt_aout.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. NOTE: the software maintainer disputes that this is a vulnerability because ASLR for a.out format executables has never been supported.

From the Ubuntu Security Team

Federico Manuel Bento discovered that the Linux kernel did not properly apply Address Space Layout Randomization (ASLR) in some situations for setuid a.out binaries. A local attacker could use this to improve the chances of exploiting an existing vulnerability in a setuid a.out binary.

Notes

This only affects i386 Ubuntu kernels. Additionally, it is very
unlikely that systems will have a setuid a.out program installed.

configuration changes to disable i386 a.out support are in
progress.

Status

Severity score breakdown

References

• https://www.openwall.com/lists/oss-security/2019/04/03/4
• https://www.openwall.com/lists/oss-security/2019/04/03/4/1
• https://ubuntu.com/security/notices/USN-4006-1
• https://ubuntu.com/security/notices/USN-4006-2
• https://ubuntu.com/security/notices/USN-4007-1
• https://ubuntu.com/security/notices/USN-4007-2
• https://ubuntu.com/security/notices/USN-4008-1
• https://ubuntu.com/security/notices/USN-4008-3
• https://www.cve.org/CVERecord?id=CVE-2019-11191
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.launchpad.net/bugs/1818552