The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass ASLR on setuid a.out programs (if any exist) because install_exec_creds() is called too late in load_aout_binary() in fs/binfmt_aout.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. NOTE: the software maintainer disputes that this is a vulnerability because ASLR for a.out format executables has never been supported
CVSS Details
- CVSS 3.1 Base Score: 2.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Apr 12, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade kernel-develUpgrade kernel-headersUpgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-sourceUpgrade perfUpgrade kernel-toolsUpgrade python-perf | Jan 3, 2020 | Apr 12, 2019 |
| Suse | — | Upgrade kernel-default | Jun 18, 2019 | Apr 11, 2019 |
| Ubuntu | — | Upgrade linux-image-raspi2Upgrade linux-image-gcpUpgrade linux-image-kvmUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-generic-lpaeUpgrade linux-image-4.15.0-51-genericUpgrade linux-image-4.18.0-1012-gcpUpgrade linux-image-4.15.0-1035-kvmUpgrade linux-image-powerpc64-embUpgrade linux-image-4.4.0-150-powerpc-e500mcUpgrade linux-image-4.15.0-51-lowlatencyUpgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-4.4.0-1047-kvmUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-4.18.0-1015-raspi2Upgrade linux-image-4.15.0-1037-raspi2Upgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-4.4.0-1114-snapdragonUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.4.0-150-genericUpgrade linux-image-4.4.0-150-powerpc64-smpUpgrade linux-image-generic-lts-xenialUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-4.15.0-51-generic-lpaeUpgrade linux-image-virtualUpgrade linux-image-4.18.0-21-generic-lpaeUpgrade linux-image-4.4.0-150-powerpc64-embUpgrade linux-image-powerpc-e500mcUpgrade linux-image-powerpc-smpUpgrade linux-image-oracleUpgrade linux-image-4.15.0-1014-oracleUpgrade linux-image-lowlatencyUpgrade linux-image-4.18.0-21-genericUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-4.4.0-150-lowlatencyUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-4.18.0-21-lowlatencyUpgrade linux-image-4.4.0-150-generic-lpaeUpgrade linux-image-4.15.0-1039-oemUpgrade linux-image-awsUpgrade linux-image-genericUpgrade linux-image-4.4.0-1110-raspi2Upgrade linux-image-4.15.0-1054-snapdragonUpgrade linux-image-aws-hweUpgrade linux-image-gkeUpgrade linux-image-powerpc64-smpUpgrade linux-image-snapdragonUpgrade linux-image-4.18.0-1013-kvmUpgrade linux-image-4.18.0-21-snapdragonUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-4.15.0-1040-awsUpgrade linux-image-4.4.0-1084-awsUpgrade linux-image-4.18.0-1017-awsUpgrade linux-image-4.15.0-1033-gcpUpgrade linux-image-oemUpgrade linux-image-4.4.0-1045-awsUpgrade linux-image-4.4.0-150-powerpc-smp | Jun 5, 2019 | Apr 11, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub