Поиск уязвимостей
Количество 10
Количество 10
CVE-2026-41054
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
CVE-2026-41054
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
CVE-2026-41054
Missing exit out of permission check in haveged could lead to root exploit
CVE-2026-41054
In `src/havegecmd.c`, the `socket_handler` function performs a credent ...
openSUSE-SU-2026:21958-1
Security update for haveged
SUSE-SU-2026:2009-1
Security update for haveged
SUSE-SU-2026:2008-1
Security update for haveged
GHSA-c5g3-m8p9-m3gh
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
BDU:2026-12851
Уязвимость компонента src/havegecmd.c генератора случайных чисел Haveged, позволяющая нарушителю вызвать отказ в обслуживании
ALT-PU-2026-14401
ALT-PU-2026-14401: package `haveged` update to version 1.9.26-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-41054 In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`. | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
 | CVE-2026-41054 In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`. | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
 | CVE-2026-41054 Missing exit out of permission check in haveged could lead to root exploit | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
| CVE-2026-41054 In `src/havegecmd.c`, the `socket_handler` function performs a credent ... | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
 | openSUSE-SU-2026:21958-1 Security update for haveged | 0% Низкий | около 2 месяцев назад | |
| SUSE-SU-2026:2009-1 Security update for haveged | 0% Низкий | 6 месяцев назад | |
| SUSE-SU-2026:2008-1 Security update for haveged | 0% Низкий | 6 месяцев назад | |
| GHSA-c5g3-m8p9-m3gh In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`. | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
 | BDU:2026-12851 Уязвимость компонента src/havegecmd.c генератора случайных чисел Haveged, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
| ALT-PU-2026-14401 ALT-PU-2026-14401: package `haveged` update to version 1.9.26-alt1 | CVSS3: 7.8 | 0% Низкий | 2 месяца назад |
Уязвимостей на страницу