Untrusted search path in wpasupplicant (Ubuntu package) - CVE-2024-5290

Vulnerability identifier: #VU95458

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-5290

CWE-ID: CWE-426

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an untrusted search path. A local user in the netdev group or access to the dbus interface of wpa_supplicant can place a malicious binary into a specific location on the system and execute arbitrary code with escalated privileges.

wpasupplicant (Ubuntu package)
wpa (Debian package)
wpa_supplicant
wpa_supplicant-debuginfo
wpa_supplicant-debugsource
wpa_supplicant-gui
wpa_supplicant-help
Debian Linux
Ubuntu
openEuler
SmartFabric Storage Software

Install updates from vendor's website.

wpasupplicant (Ubuntu package) - addressed in versions 2:2.10-21ubuntu0.1, 2.1-0ubuntu1.7+esm5, 2.4-0ubuntu6.8+esm1, 2:2.6-15ubuntu2.8+esm1, 2:2.9-1ubuntu4.4, 2:2.10-6ubuntu2.1
SmartFabric Storage Software - update to 1.4.3
wpa (Debian package) - addressed in versions 2:2.9.0-21+deb11u2, 2:2.10-12+deb12u2
wpa_supplicant - update to 2.10-7
wpa_supplicant-debuginfo - update to 2.10-7
wpa_supplicant-debugsource - update to 2.10-7
wpa_supplicant-gui - update to 2.10-7
wpa_supplicant-help - update to 2.10-7

• Exploit #11120 - CVE-2024-5290-exp (February 7, 2025)
• Exploit #11117 - CVE-2024-35235-CVE-2024-5290-exp (February 7, 2025)

• https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613
• https://ubuntu.com/security/notices/USN-6945-1

• Debian update for wpa
• Ubuntu update for wpa
• openEuler update for wpa_supplicant
• Dell SmartFabric Storage Software update for third-party components