CVE-2019-9893
First published: Wed Mar 20 2019(Updated: )
A security issue was discovered in current versions of libseccomp where the library did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE).It would appear that only systemd and Tor are using libseccomp in such a way as to trigger the bad code. In the case of systemd this appears to affect the socket address family and scheduling class filters. In the case of Tor it appears that the bad filters could impact the memory addresses passed to mprotect(2). Reference: <a href="https://www.openwall.com/lists/oss-security/2019/03/15/1">https://www.openwall.com/lists/oss-security/2019/03/15/1</a> Commits: <a href="https://github.com/seccomp/libseccomp/commit/c5bf78de480b32b324e0f511c88ce533ed280b37">https://github.com/seccomp/libseccomp/commit/c5bf78de480b32b324e0f511c88ce533ed280b37</a> <a href="https://github.com/seccomp/libseccomp/commit/cf5d1538d243fb6f1839db70b69469d3d7e9e077">https://github.com/seccomp/libseccomp/commit/cf5d1538d243fb6f1839db70b69469d3d7e9e077</a> <a href="https://github.com/seccomp/libseccomp/commit/2878b8ba7859cf1771795ebef5c85ec211756dca">https://github.com/seccomp/libseccomp/commit/2878b8ba7859cf1771795ebef5c85ec211756dca</a> <a href="https://github.com/seccomp/libseccomp/commit/3da42d78e26cd16282bee85fcd817115b7f91af0">https://github.com/seccomp/libseccomp/commit/3da42d78e26cd16282bee85fcd817115b7f91af0</a> <a href="https://github.com/seccomp/libseccomp/commit/b29eda913b11ca339a7c1727fdc7e3309dd2a9b6">https://github.com/seccomp/libseccomp/commit/b29eda913b11ca339a7c1727fdc7e3309dd2a9b6</a>
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Libseccomp Project Libseccomp | <2.4.0 | |
| redhat/libseccomp | <2.4.0 | 2.4.0 |
| debian/libseccomp | 2.5.1-1+deb11u1 2.5.4-1+deb12u1 2.5.5-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00027.html
- https://access.redhat.com/errata/RHSA-2019:3624
- https://github.com/seccomp/libseccomp/issues/139
- https://seclists.org/oss-sec/2019/q1/179
- https://security.gentoo.org/glsa/201904-18
- https://usn.ubuntu.com/4001-1/
- https://usn.ubuntu.com/4001-2/
- https://launchpad.net/bugs/cve/CVE-2019-9893
- https://www.openwall.com/lists/oss-security/2019/03/15/1
- https://github.com/seccomp/libseccomp/commit/c5bf78de480b32b324e0f511c88ce533ed280b37
- https://github.com/seccomp/libseccomp/commit/cf5d1538d243fb6f1839db70b69469d3d7e9e077
- https://github.com/seccomp/libseccomp/commit/2878b8ba7859cf1771795ebef5c85ec211756dca
- https://github.com/seccomp/libseccomp/commit/3da42d78e26cd16282bee85fcd817115b7f91af0
- https://github.com/seccomp/libseccomp/commit/b29eda913b11ca339a7c1727fdc7e3309dd2a9b6
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1690898
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1688903
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1688905
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1688906
- https://access.redhat.com/security/cve/cve-2019-9893
- https://bugzilla.redhat.com/show_bug.cgi?id=1690897
- https://security-tracker.debian.org/tracker/CVE-2019-9893
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9893
- https://nvd.nist.gov/vuln/detail/CVE-2019-9893
- https://ubuntu.com/security/CVE-2019-9893
- collector/nvd-index
- agent/type
- agent/remedy
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-9893
- agent/software-canonical-lookup
- agent/severity
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- collector/nvd-cve
- agent/softwarecombine
- agent/trending
- vendor/libseccomp project
- canonical/libseccomp project libseccomp
- package-manager/redhat
- package-manager/debian