CVE-2019-13178 Race condition in n/a
A race condition in Calamares allows attackers to read LUKS encryption keyfiles before secure permissions are applied.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-13178?
CVE-2019-13178 is a high-severity vulnerability in n/a, published on 2 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.
Weakness: CWE-362
Which versions are affected by CVE-2019-13178?
It affects 1 product.
Linux distribution packages (4)
calamares SUSE:Package Hub 15 | All versions | 3.2.15-bp150.2.6.1 |
calamares SUSE:Package Hub 15 SP1 | All versions | 3.2.15-bp151.4.3.1 |
calamares openSUSE:Leap 15.0 | All versions | 3.2.15-lp151.4.3.3 |
calamares openSUSE:Leap 15.1 | All versions | 3.2.15-lp151.4.3.3 |
Products include Calamares Calamares.
How do I fix CVE-2019-13178?
Apply the vendor's patch.
Is CVE-2019-13178 being exploited?
There is no known exploitation of CVE-2019-13178 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2019-13178, GHSA-j52x-jwvh-c5gg, UBUNTU-CVE-2019-13178, openSUSE-SU-2019:2628-1, openSUSE-SU-2019:2654-1, openSUSE-SU-2019:2655-1 and 1 more.