CVE-2019-11191

kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs

Loading…

Severity

Low

Red Hat Product Security

2.5

CVSS 3.0

Review impact separately from score.

Published · April 3, 2019

Updated · June 28, 2026

Description

The Linux kernel allows local users to bypass ASLR protections for setuid a.out programs when CONFIG_IA32_AOUT is enabled and ia32_aout module is loaded, because install_exec_creds() is called too late in the load_aout_binary() in fs/binfmt_aout.c. Due to this, the ptrace_may_access() check may have a race condition with install_exec_creds() when reading /proc/pid/stat file and reveal information on addresses of kernel structures, henceforth defeating the KASLR protection.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 2.5
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')