CVE-2019-18276 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2019-18276 Interim 1 15 2025-02-17T01:52:45Z current 2021-05-30T14:32:40Z 2025-02-17T01:52:45Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2019-18276 An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Liberty Linux 8 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Server 11 SP3 for Teradata SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP3 bash bash-4.4.19-14.el8 bash-devel bash-doc bash-doc-4.4.19-14.el8 bash-lang libreadline6 libreadline6-32bit libreadline7 libreadline7-32bit readline-devel readline-doc bash-4.4.19-14.el8 as a component of SUSE Liberty Linux 8 bash-doc-4.4.19-14.el8 as a component of SUSE Liberty Linux 8 bash as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 bash as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS bash-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS bash-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS bash-lang as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libreadline7 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libreadline7-32bit as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS readline-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS readline-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS bash as a component of SUSE Linux Enterprise Micro 5.1 libreadline7 as a component of SUSE Linux Enterprise Micro 5.1 bash as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 bash-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 bash-doc as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 bash-lang as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libreadline7 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libreadline7-32bit as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 readline-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 readline-doc as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 bash as a component of SUSE Linux Enterprise Server 11 SP3 for Teradata bash as a component of SUSE Linux Enterprise Server 12 SP3-LTSS bash-doc as a component of SUSE Linux Enterprise Server 12 SP3-LTSS libreadline6 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS libreadline6-32bit as a component of SUSE Linux Enterprise Server 12 SP3-LTSS readline-doc as a component of SUSE Linux Enterprise Server 12 SP3-LTSS bash as a component of SUSE Linux Enterprise Server 12 SP4-LTSS bash-doc as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libreadline6 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libreadline6-32bit as a component of SUSE Linux Enterprise Server 12 SP4-LTSS readline-doc as a component of SUSE Linux Enterprise Server 12 SP4-LTSS bash as a component of SUSE Linux Enterprise Server 12 SP5 bash-doc as a component of SUSE Linux Enterprise Server 12 SP5 libreadline6 as a component of SUSE Linux Enterprise Server 12 SP5 libreadline6-32bit as a component of SUSE Linux Enterprise Server 12 SP5 readline-doc as a component of SUSE Linux Enterprise Server 12 SP5 bash as a component of SUSE Linux Enterprise Server Teradata 12 SP3 bash as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 bash-doc as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libreadline6 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libreadline6-32bit as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 readline-doc as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 bash as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 bash-doc as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libreadline6 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libreadline6-32bit as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 readline-doc as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 bash as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 bash-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 readline-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 bash as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 bash-lang as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 bash as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected. CVE-2019-18276 SUSE Liberty Linux 8:bash-4.4.19-14.el8 SUSE Liberty Linux 8:bash-doc-4.4.19-14.el8 SUSE Linux Enterprise High Performance Computing 12 SP5:bash SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:bash SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:bash-devel SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:bash-doc SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:bash-lang SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libreadline7 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libreadline7-32bit SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:readline-devel SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:readline-doc SUSE Linux Enterprise Micro 5.1:bash SUSE Linux Enterprise Micro 5.1:libreadline7 SUSE Linux Enterprise Module for Basesystem 15 SP3:bash SUSE Linux Enterprise Module for Basesystem 15 SP3:bash-devel SUSE Linux Enterprise Module for Basesystem 15 SP3:bash-doc SUSE Linux Enterprise Module for Basesystem 15 SP3:bash-lang SUSE Linux Enterprise Module for Basesystem 15 SP3:libreadline7 SUSE Linux Enterprise Module for Basesystem 15 SP3:libreadline7-32bit SUSE Linux Enterprise Module for Basesystem 15 SP3:readline-devel SUSE Linux Enterprise Module for Basesystem 15 SP3:readline-doc SUSE Linux Enterprise Server 11 SP3 for Teradata:bash SUSE Linux Enterprise Server 12 SP3-LTSS:bash SUSE Linux Enterprise Server 12 SP3-LTSS:bash-doc SUSE Linux Enterprise Server 12 SP3-LTSS:libreadline6 SUSE Linux Enterprise Server 12 SP3-LTSS:libreadline6-32bit SUSE Linux Enterprise Server 12 SP3-LTSS:readline-doc SUSE Linux Enterprise Server 12 SP4-LTSS:bash SUSE Linux Enterprise Server 12 SP4-LTSS:bash-doc SUSE Linux Enterprise Server 12 SP4-LTSS:libreadline6 SUSE Linux Enterprise Server 12 SP4-LTSS:libreadline6-32bit SUSE Linux Enterprise Server 12 SP4-LTSS:readline-doc SUSE Linux Enterprise Server 12 SP5:bash SUSE Linux Enterprise Server 12 SP5:bash-doc SUSE Linux Enterprise Server 12 SP5:libreadline6 SUSE Linux Enterprise Server 12 SP5:libreadline6-32bit SUSE Linux Enterprise Server 12 SP5:readline-doc SUSE Linux Enterprise Server Teradata 12 SP3:bash SUSE Linux Enterprise Server for SAP Applications 12 SP3:bash SUSE Linux Enterprise Server for SAP Applications 12 SP3:bash-doc SUSE Linux Enterprise Server for SAP Applications 12 SP3:libreadline6 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libreadline6-32bit SUSE Linux Enterprise Server for SAP Applications 12 SP3:readline-doc SUSE Linux Enterprise Server for SAP Applications 12 SP4:bash SUSE Linux Enterprise Server for SAP Applications 12 SP4:bash-doc SUSE Linux Enterprise Server for SAP Applications 12 SP4:libreadline6 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libreadline6-32bit SUSE Linux Enterprise Server for SAP Applications 12 SP4:readline-doc SUSE Linux Enterprise Server for SAP Applications 12 SP5:bash SUSE Linux Enterprise Software Development Kit 12 SP5:bash SUSE Linux Enterprise Software Development Kit 12 SP5:bash-devel SUSE Linux Enterprise Software Development Kit 12 SP5:readline-devel SUSE Linux Enterprise Workstation Extension 12 SP5:bash SUSE Linux Enterprise Workstation Extension 12 SP5:bash-lang low 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N