CVE-2019-19126 is a low-severity vulnerability affecting the GNU C Library (glibc) on x86-64 architectures before version 2.31, impacting products from Canonical, Debian, Fedora Project, and GNU. It allows local attackers to bypass ASLR for setuid programs by manipulating the LD_PREFER_MAP_32BIT_EXEC environment variable after a security transition. The CVSS score is 3.3 (Low), indicating a local attack vector with low complexity, potentially leading to a limited confidentiality impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.31CPE matchmatch criteria | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:x64:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | ||
18.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | ||
19.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | ||
30CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2019-19126
Sep 8, 2020glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries
Nov 19, 2019On the x86-64 architecture the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.
Nov 12, 2019