Vulnerability · Published Aug 7, 2024 · Assigned by canonical
CVE-2024-5290
High 8.8
In plain English
A high-severity uncontrolled search path in wpa_supplicant from Canonical Ltd.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root). Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | wpa | 2:2.10-12+deb12u2 | DSA-5739-1 |
| Debian:12 | wpa | 2:2.10-12+deb12u2 | DEBIAN-CVE-2024-5290 |
| Debian:13 | wpa | 2:2.10-22 | DEBIAN-CVE-2024-5290 |
| Debian:14 | wpa | 2:2.10-22 | DEBIAN-CVE-2024-5290 |
| Ubuntu:22.04:LTS | wpa | 2:2.10-6ubuntu2.1 | USN-6945-1 |
| Ubuntu:22.04:LTS | wpa | 2:2.10-6ubuntu2.1 | UBUNTU-CVE-2024-5290 |
| Ubuntu:24.04:LTS | wpa | 2:2.10-21ubuntu0.1 | UBUNTU-CVE-2024-5290 |
| Ubuntu:24.04:LTS | wpa | 2:2.10-21ubuntu0.1 | USN-6945-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical Ltd. | wpa_supplicant | 2:2.10-15 – before 2:2.10-21ubuntu0.12:2.9.0-21build1 – before 2:2.10-6ubuntu2.12:2.9-1ubuntu2 – before 2:2.9-1ubuntu4.42.4-0ubuntu10 – before 2:2.6-15ubuntu2.8+esm12.4-0ubuntu3 – before 2.4-0ubuntu6.8+esm12.1-0ubuntu1 – before 2.1-0ubuntu1.7+esm5 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H