CVE-2019-17053: Low severity Linux Linux kernel vulnerability
A vulnerability was discovered in ieee802154create in net/ieee802154/socket.c in the AFIEEE802154 protocol module in the Linux kernel which did not enforcepermission checks. This could allow a local unprivileged user to create a raw socket.
Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e69dbd4619e7674c1679cba49afd9dd9ac347eef
Other sources
A vulnerability was discovered in the Linux kernel's AFIEEE802154 networking module where permissions checks are not enforced. This can allow an unprivileged user to create raw sockets for this protocol leading to the potential for data leaks or system unavailability.
ieee802154create in net/ieee802154/socket.c in the AFIEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAPNETRAW, which means that unprivileged users can create a raw socket, aka CID-e69dbd4619e7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.rt13.51.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-17053?
CVE-2019-17053 is classified as a high severity vulnerability due to inadequate permissions allowing local unprivileged users to create raw sockets.
How do I fix CVE-2019-17053?
To fix CVE-2019-17053, update to a version of the Linux kernel that is patched, such as 0:3.10.0-1160.rt56.1131.el7 or later.
Who is affected by CVE-2019-17053?
CVE-2019-17053 affects users of the Linux kernel versions up to 5.3.2 without the necessary permission checks implemented.
What platforms are impacted by CVE-2019-17053?
CVE-2019-17053 impacts Red Hat and Debian distributions running certain versions of the Linux kernel.
Can CVE-2019-17053 be exploited remotely?
No, CVE-2019-17053 requires local access for exploitation, as it allows local users to create raw sockets.