Incorrect default permissions in Linux kernel - CVE-2019-15793

Vulnerability identifier: #VU95690

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-15793

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into init_user_ns, whereas they should have been translated into the s_user_ns for the lower filesystem. This resulted in using ids other than the intended ones in the lower fs, which likely did not map into the shifts s_user_ns. A local attacker could use this to possibly bypass discretionary access control permissions.

Linux kernel
Ubuntu
linux-azure (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-hwe (Ubuntu package)
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-kvm (Ubuntu package)
linux-raspi2 (Ubuntu package)
linux-oem-osp1 (Ubuntu package)
linux-gke-5.0 (Ubuntu package)

Install update from vendor's repository.

linux-azure (Ubuntu package) - addressed in versions 5.0.0-1025.27~18.04.1, 5.0.0-1025.27, 5.3.0-1007.8
linux-gcp (Ubuntu package) - addressed in versions 5.0.0-1025.26~18.04.1, 5.0.0-1025.26, 5.3.0-1008.9
linux-oracle (Ubuntu package) - addressed in versions 5.0.0-1007.12, 5.3.0-1006.7
linux-hwe (Ubuntu package) - update to 5.0.0-35.38~18.04.1
linux (Ubuntu package) - addressed in versions 5.0.0-35.38, 5.3.0-22.24
linux-aws (Ubuntu package) - addressed in versions 5.0.0-1021.24, 5.3.0-1007.8
linux-kvm (Ubuntu package) - addressed in versions 5.0.0-1022.24, 5.3.0-1007.8
linux-raspi2 (Ubuntu package) - update to 5.0.0-1022.23
linux-oem-osp1 (Ubuntu package) - update to 5.0.0-1027.31
linux-gke-5.0 (Ubuntu package) - update to 5.0.0-1025.26~18.04.1

• https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=3644b9d5688da86f18e017c9c580b75cf52927bb
• https://usn.ubuntu.com/usn/usn-4183-1
• https://usn.ubuntu.com/usn/usn-4184-1

• Incorrect default permissions in Linux kernel
• Ubuntu update for linux, linux-aws, linux-azure and more
• Ubuntu update for linux, linux-aws, linux-azure and more