CVE-2019-20044

HIGH

zsh < 5.8 - Privilege Escalation via Module Path Manipulation

Title source: llm
STIX 2.1

Description

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

References (20)

Core 20
Core References
Release Notes, Third Party Advisory x_refsource_misc
http://zsh.sourceforge.net/releases.html
Release Notes, Vendor Advisory x_refsource_misc
https://www.zsh.org/mla/zsh-announce/141
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/03/msg00004.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202003-55
Third Party Advisory x_refsource_confirm
https://support.apple.com/kb/HT211170
Third Party Advisory x_refsource_confirm
https://support.apple.com/kb/HT211175
Third Party Advisory x_refsource_confirm
https://support.apple.com/kb/HT211171
Third Party Advisory x_refsource_confirm
https://support.apple.com/kb/HT211168
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/May/49
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/May/55
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/May/53
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/May/59
Third Party Advisory x_refsource_confirm
https://support.apple.com/HT211168
Third Party Advisory x_refsource_confirm
https://support.apple.com/HT211170
Third Party Advisory x_refsource_confirm
https://support.apple.com/HT211171
Third Party Advisory x_refsource_confirm
https://support.apple.com/HT211175
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html

Scores

CVSS v3 7.8
EPSS 0.0050
EPSS Percentile 39.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-273
Status published
Products (12)
apple/ipados < 13.5
apple/iphone_os < 13.5
apple/mac_os_x 10.13.6 (12 CPE variants)
apple/mac_os_x 10.14.6 (9 CPE variants)
apple/mac_os_x < 10.15.5
apple/tvos < 13.4.5
apple/watchos < 6.2.5
debian/debian_linux 8.0
debian/debian_linux 9.0
fedoraproject/fedora 30
... and 2 more
Published Feb 24, 2020
Tracked Since Feb 18, 2026