Описание
In src/havegecmd.c, the socket_handler function performs a credential check on the abstract UNIX socket (\0/sys/entropy/haveged). However, while it detects if the connecting user is not root (cred.uid != 0) and prepares a negative acknowledgement (ASCII_NAK), it fails to stop execution. The code proceeds to the switch statement, allowing any local unprivileged user to execute privileged commands such as MAGIC_CHROOT.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.9.26-1 |
| esm-apps-legacy/xenial | not-affected | code not present |
| esm-apps/bionic | not-affected | code not present |
| esm-apps/focal | not-affected | code not present |
| esm-apps/jammy | released | 1.9.14-1ubuntu1+esm1~22.04.1 |
| esm-apps/noble | released | 1.9.14-1ubuntu2+esm1~24.04.1 |
| esm-apps/resolute | released | 1.9.19-14ubuntu0.1 |
| esm-infra-legacy/trusty | not-affected | code not present |
| jammy | needed | |
| noble | needed |
Показывать по
Ссылки на источники
EPSS
7.8 High
CVSS3
Связанные уязвимости
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
Missing exit out of permission check in haveged could lead to root exploit
In `src/havegecmd.c`, the `socket_handler` function performs a credent ...
EPSS
7.8 High
CVSS3