Riskcovery

CVE-2024-5290

State
Published
Severity
8.8 High
Published
Aug 7, 2024
Updated
Sep 18, 2024
Reserved
May 23, 2024

Read the record on cve.org

Description

An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).

Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hcanonical

Weaknesses

  • CWE-427 Uncontrolled Search Path Element

Affected Products

ProductVersions
wpa_supplicantCanonical Ltd.
  • 2:2.10-15 to before 2:2.10-21ubuntu0.1Affected
  • 2:2.9.0-21build1 to before 2:2.10-6ubuntu2.1Affected
  • 2:2.9-1ubuntu2 to before 2:2.9-1ubuntu4.4Affected
  • 2.4-0ubuntu10 to before 2:2.6-15ubuntu2.8+esm1Affected
  • 2.4-0ubuntu3 to before 2.4-0ubuntu6.8+esm1Affected
  • 2.1-0ubuntu1 to before 2.1-0ubuntu1.7+esm5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.