CVE-2024-5290

2024-08-0708:14:08

CWE-427

canonical

github.com

cve-2024-5290

ubuntu

wpa_supplicant

privilege escalation

netdev group

dbus interface

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

Percentile

5.1%

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).

Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:w1.fi:wpa_supplicant:*:*:*:*:*:*:*:*"
    ],
    "vendor": "w1.fi",
    "product": "wpa_supplicant",
    "versions": [
      {
        "status": "affected",
        "version": "2:2.10-15",
        "lessThan": "2:2.10-21ubuntu0.1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2:2.9.0-21build1",
        "lessThan": "2:2.10-6ubuntu2.1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2:2.9-1ubuntu2",
        "lessThan": "2:2.9-1ubuntu4.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.4-0ubuntu10",
        "lessThan": "2:2.6-15ubuntu2.8+esm1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.4-0ubuntu3",
        "lessThan": "2.4-0ubuntu6.8+esm1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.1-0ubuntu1",
        "lessThan": "2.1-0ubuntu1.7+esm5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]