CVE-2019-19126

Published: 19 November 2019

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

Priority

Low

CVSS 3 base score: 3.3

Status

Package Release Status
eglibc
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 ESM (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable

glibc
Launchpad, Ubuntu, Debian
Upstream
Released (2.31)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(2.31-0ubuntu7)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (2.27-3ubuntu1.2)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (2.23-0ubuntu11.2)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

Patches:
Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d5dfad4326fc683c813df1e37bbf5cf920591c8e