Insecure Inherited Permissions in Mesa 3D Graphics Library - CVE-2019-5068

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU22552

Insecure Inherited Permissions in Mesa 3D Graphics Library - CVE-2019-5068

Published: November 6, 2019


Vulnerability identifier: #VU22552
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-5068
CWE-ID:
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to gain access to sensitive information on the target system.

The vulnerability exists due to the shared memory permissions issue. A local attacker can access the shared memory without any specific permissions and gain access to sensitive information.

Affected software

Mesa 3D Graphics Library
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
Opensuse
mesa (Ubuntu package)
libxatracker2-debuginfo
libxatracker-devel
libxatracker2
Mesa-libGL1-debuginfo
libgbm1-debuginfo-32bit
libgbm1-debuginfo
libgbm1-32bit
libgbm1
Mesa-libglapi0-debuginfo-32bit
Mesa-libglapi0-debuginfo
Mesa-libglapi0-32bit
Mesa-libglapi0
Mesa-libGLESv2-2-debuginfo
Mesa-libGLESv2-2
Mesa-libGL1-debuginfo-32bit
Mesa-libGL1-32bit
Mesa-libGL1
Mesa-libEGL1-debuginfo-32bit
Mesa-libEGL1-debuginfo
Mesa-libEGL1-32bit
Mesa-libEGL1
Mesa-debugsource
Mesa-debuginfo-32bit
Mesa-debuginfo
Mesa-32bit
Mesa

How to mitigate CVE-2019-5068

Install updates from vendor's website.

Mesa 3D Graphics Library - update to 19.1.3
mesa (Ubuntu package) - addressed in versions 19.2.8-0ubuntu0~18.04.2, 19.2.8-0ubuntu0~19.10.2
libxatracker2-debuginfo - update to 1.0.0-104.9.49
libxatracker-devel - update to 1.0.0-104.9.49
libxatracker2 - update to 1.0.0-104.9.49
Mesa-libGL1-debuginfo - update to 11.2.1-104.9.49
libgbm1-debuginfo-32bit - update to 11.2.1-104.9.49
libgbm1-debuginfo - update to 11.2.1-104.9.49
libgbm1-32bit - update to 11.2.1-104.9.49
libgbm1 - update to 11.2.1-104.9.49
Mesa-libglapi0-debuginfo-32bit - update to 11.2.1-104.9.49
Mesa-libglapi0-debuginfo - update to 11.2.1-104.9.49
Mesa-libglapi0-32bit - update to 11.2.1-104.9.49
Mesa-libglapi0 - update to 11.2.1-104.9.49
Mesa-libGLESv2-2-debuginfo - update to 11.2.1-104.9.49
Mesa-libGLESv2-2 - update to 11.2.1-104.9.49
Mesa-libGL1-debuginfo-32bit - update to 11.2.1-104.9.49
Mesa-libGL1-32bit - update to 11.2.1-104.9.49
Mesa-libGL1 - update to 11.2.1-104.9.49
Mesa-libEGL1-debuginfo-32bit - update to 11.2.1-104.9.49
Mesa-libEGL1-debuginfo - update to 11.2.1-104.9.49
Mesa-libEGL1-32bit - update to 11.2.1-104.9.49
Mesa-libEGL1 - update to 11.2.1-104.9.49
Mesa-debugsource - update to 11.2.1-104.9.49
Mesa-debuginfo-32bit - update to 11.2.1-104.9.49
Mesa-debuginfo - update to 11.2.1-104.9.49
Mesa-32bit - update to 11.2.1-104.9.49
Mesa - update to 11.2.1-104.9.49

External References

Related Security Bulletins