Incorrect calculation in libseccomp - CVE-2019-9893

Vulnerability identifier: #VU18322

CSH Severity: Low

CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-9893

CWE-ID: CWE-682

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due to incorrect 64-bit syscall argument comparison when using arithmetic operators, such as LT, GT, LE, or GE. A local user can bypass seccomp filters and gain elevated privileges on the system.

libseccomp
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Opensuse
DataMosaix Private Cloud
Dell PowerProtect Cyber Recovery
libseccomp (Ubuntu package)
libseccomp (Alpine package)

Install updates from vendor's website.

libseccomp - update to 2.4.0
DataMosaix Private Cloud - update to 7.09
libseccomp (Ubuntu package) - addressed in versions 2.4.1-0ubuntu0.16.04.2, 2.4.1-0ubuntu0.18.04.2, 2.4.1-0ubuntu0.18.10.3, 2.4.1-0ubuntu0.19.04.3
libseccomp (Alpine package) - addressed in versions 2.4.0-r0, 2.4.2-r2
Dell PowerProtect Cyber Recovery - update to 18.1.1.2-8

• https://github.com/seccomp/libseccomp/issues/139
• https://seclists.org/oss-sec/2019/q1/179
• https://security.gentoo.org/glsa/201904-18

• Gentoo update for libseccomp
• Ubuntu update for libseccomp
• OpenSUSE Linux update for libseccomp
• OpenSUSE Linux update for libseccomp
• Red Hat update for libseccomp
• Incorrect calculation in libseccomp (Alpine package)
• Multiple vulnerabilities in Dell EMC Cyber Recovery
• Multiple vulnerabilities in Rockwell Automation DataMosaix Private Cloud