Missing exit out of permission check in haveged could lead to root exploit
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.9.14-150400.3.11.1, 1.9.14-150600.11.6.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it fails to stop execution. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
Timeline
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- CVE published
- Record last updated
Affected versions
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150600.11.6.1
- haveged-devel
fixed in 1.9.14-150600.11.6.1
- libhavege2
fixed in 1.9.14-150600.11.6.1
- haveged
fixed in 1.9.14-150600.11.6.1
- haveged-devel
fixed in 1.9.14-150600.11.6.1
- libhavege2
fixed in 1.9.14-150600.11.6.1
- haveged
fixed in 1.9.14-150600.11.6.1
- haveged-devel
fixed in 1.9.14-150600.11.6.1
- libhavege2
fixed in 1.9.14-150600.11.6.1
- haveged
fixed in 1.9.14-150600.11.6.1
- haveged-devel
fixed in 1.9.14-150600.11.6.1
- libhavege2
fixed in 1.9.14-150600.11.6.1
- haveged
fixed in 1.9.14-150600.11.6.1
- haveged-devel
fixed in 1.9.14-150600.11.6.1
- libhavege2
fixed in 1.9.14-150600.11.6.1
- haveged
fixed in 1.9.14-150400.3.11.1
- haveged-devel
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- haveged-devel
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- haveged-devel
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- haveged-devel
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- haveged-devel
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- haveged-devel
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150600.11.6.1
- haveged-devel
fixed in 1.9.14-150600.11.6.1
- libhavege2
fixed in 1.9.14-150600.11.6.1
- haveged
fixed in 1.9.14-150400.3.11.1
- haveged-devel
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- haveged-devel
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150600.11.6.1
- haveged-devel
fixed in 1.9.14-150600.11.6.1
- libhavege2
fixed in 1.9.14-150600.11.6.1
- haveged
fixed in 1.9.14-150400.3.11.1
- haveged-devel
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- haveged-devel
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1
- haveged
fixed in 1.9.14-150400.3.11.1
- haveged-devel
fixed in 1.9.14-150400.3.11.1
- libhavege2
fixed in 1.9.14-150400.3.11.1