Improper privilege management in PPP - CVE-2024-58250

Vulnerability identifier: #VU111868

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-58250

CWE-ID: CWE-269

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper privilege management within the passprompt plugin in pppd. A local user can escalate privileges on the system.

PPP
openEuler
Anolis OS
ppp
ppp-debuginfo
ppp-debugsource
ppp-devel
ppp-help
network-scripts-ppp
ppp-doc

Install updates from vendor's website.

PPP - update to 2.5.2
ppp - update to 2.5.0-5
ppp-debuginfo - update to 2.5.0-5
ppp-debugsource - update to 2.5.0-5
ppp-devel - update to 2.5.0-5
ppp-help - update to 2.5.0-5
ppp - update to 2.5.2-1
network-scripts-ppp - update to 2.5.2-1
ppp-devel - update to 2.5.2-1
ppp-doc - update to 2.5.2-1

• https://github.com/ppp-project/ppp/commit/0a66ad22e54c72690ec2a29a019767c55c5281fc
• https://github.com/ppp-project/ppp/compare/v2.5.1...v2.5.2

• Privilege escalation in pppd
• openEuler update for ppp
• Anolis OS update for ppp