Vulnerabilities > CVE-2019-9893 - Unspecified vulnerability in Libseccomp Project Libseccomp

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
libseccomp-project
critical
nessus
NVD
Published: 2019-03-21
Updated: 2024-11-21

Summary

libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.

Vulnerable Configurations

Part Description Count
Application
Libseccomp_Project
14

Nessus

  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1293.NASL
    descriptionAccording to the versions of the libcomps packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.(CVE-2019-3817) - libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.(CVE-2019-9893) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-03
    modified2020-03-23
    plugin id134785
    published2020-03-23
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134785
    titleEulerOS 2.0 SP8 : libcomps (EulerOS-SA-2020-1293)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(134785);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/01");

  script_cve_id(
    "CVE-2019-3817",
    "CVE-2019-9893"
  );

  script_name(english:"EulerOS 2.0 SP8 : libcomps (EulerOS-SA-2020-1293)");
  script_summary(english:"Checks the rpm output for the updated packages.");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the libcomps packages installed, the
EulerOS installation on the remote host is affected by the following
vulnerabilities :

  - A use-after-free flaw has been discovered in libcomps
    before version 0.1.10 in the way ObjMRTrees are merged.
    An attacker, who is able to make an application read a
    crafted comps XML file, may be able to crash the
    application or execute malicious code.(CVE-2019-3817)

  - libseccomp before 2.4.0 did not correctly generate
    64-bit syscall argument comparisons using the
    arithmetic operators (LT, GT, LE, GE), which might able
    to lead to bypassing seccomp filters and potential
    privilege escalations.(CVE-2019-9893)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1293
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b1f2522c");
  script_set_attribute(attribute:"solution", value:
"Update the affected libcomps packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libcomps");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libcomps-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python2-libcomps");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-libcomps");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");

sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(8)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP8");

uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP8", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

flag = 0;

pkgs = ["libcomps-0.1.8-14.h1.eulerosv2r8",
        "libcomps-devel-0.1.8-14.h1.eulerosv2r8",
        "python2-libcomps-0.1.8-14.h1.eulerosv2r8",
        "python3-libcomps-0.1.8-14.h1.eulerosv2r8"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"8", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libcomps");
}
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2025.NASL
    descriptionAccording to the version of the libseccomp package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.(CVE-2019-9893) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-08
    modified2019-09-24
    plugin id129218
    published2019-09-24
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129218
    titleEulerOS 2.0 SP3 : libseccomp (EulerOS-SA-2019-2025)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(129218);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");

  script_cve_id(
    "CVE-2019-9893"
  );

  script_name(english:"EulerOS 2.0 SP3 : libseccomp (EulerOS-SA-2019-2025)");
  script_summary(english:"Checks the rpm output for the updated package.");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"According to the version of the libseccomp package installed, the
EulerOS installation on the remote host is affected by the following
vulnerability :

  - libseccomp before 2.4.0 did not correctly generate
    64-bit syscall argument comparisons using the
    arithmetic operators (LT, GT, LE, GE), which might able
    to lead to bypassing seccomp filters and potential
    privilege escalations.(CVE-2019-9893)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2025
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fad88767");
  script_set_attribute(attribute:"solution", value:
"Update the affected libseccomp package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"patch_publication_date", value:"2019/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/09/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libseccomp");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");

sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(3)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3");

uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

flag = 0;

pkgs = ["libseccomp-2.3.1-3.h3"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"3", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libseccomp");
}
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4001-1.NASL
    descriptionJann Horn discovered that libseccomp did not correctly generate 64-bit syscall argument comparisons with arithmetic operators (LT, GT, LE, GE). An attacker could use this to bypass intended access restrictions for argument-filtered system calls. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id125624
    published2019-05-31
    reporterUbuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125624
    titleUbuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : libseccomp vulnerability (USN-4001-1)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-4001-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(125624);
  script_version("1.3");
  script_cvs_date("Date: 2020/01/13");

  script_cve_id("CVE-2019-9893");
  script_xref(name:"USN", value:"4001-1");

  script_name(english:"Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : libseccomp vulnerability (USN-4001-1)");
  script_summary(english:"Checks dpkg output for updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Ubuntu host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Jann Horn discovered that libseccomp did not correctly generate 64-bit
syscall argument comparisons with arithmetic operators (LT, GT, LE,
GE). An attacker could use this to bypass intended access restrictions
for argument-filtered system calls.

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/4001-1/"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected libseccomp2 package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libseccomp2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.04");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/31");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(16\.04|18\.04|18\.10|19\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 16.04 / 18.04 / 18.10 / 19.04", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"16.04", pkgname:"libseccomp2", pkgver:"2.4.1-0ubuntu0.16.04.2")) flag++;
if (ubuntu_check(osver:"18.04", pkgname:"libseccomp2", pkgver:"2.4.1-0ubuntu0.18.04.2")) flag++;
if (ubuntu_check(osver:"18.10", pkgname:"libseccomp2", pkgver:"2.4.1-0ubuntu0.18.10.3")) flag++;
if (ubuntu_check(osver:"19.04", pkgname:"libseccomp2", pkgver:"2.4.1-0ubuntu0.19.04.3")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libseccomp2");
}
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2019-1360.NASL
    descriptionlibseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations. (CVE-2019-9893)
    last seen2020-06-01
    modified2020-06-02
    plugin id131028
    published2019-11-15
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131028
    titleAmazon Linux 2 : libseccomp (ALAS-2019-1360)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2019-1360.
#

include("compat.inc");

if (description)
{
  script_id(131028);
  script_version("1.2");
  script_cvs_date("Date: 2019/12/12");

  script_cve_id("CVE-2019-9893");
  script_xref(name:"ALAS", value:"2019-1360");

  script_name(english:"Amazon Linux 2 : libseccomp (ALAS-2019-1360)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Amazon Linux 2 host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"libseccomp before 2.4.0 did not correctly generate 64-bit syscall
argument comparisons using the arithmetic operators (LT, GT, LE, GE),
which might able to lead to bypassing seccomp filters and potential
privilege escalations. (CVE-2019-9893)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://alas.aws.amazon.com/AL2/ALAS-2019-1360.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Run 'yum update libseccomp' to update your system."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libseccomp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libseccomp-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libseccomp-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libseccomp-static");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/11/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/15");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Amazon Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/AmazonLinux/release");
if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (rpm_check(release:"AL2", reference:"libseccomp-2.4.1-1.amzn2")) flag++;
if (rpm_check(release:"AL2", reference:"libseccomp-debuginfo-2.4.1-1.amzn2")) flag++;
if (rpm_check(release:"AL2", reference:"libseccomp-devel-2.4.1-1.amzn2")) flag++;
if (rpm_check(release:"AL2", reference:"libseccomp-static-2.4.1-1.amzn2")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libseccomp / libseccomp-debuginfo / libseccomp-devel / etc");
}
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-1_0-0228_TAR.NASL
    descriptionAn update of the tar package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id124868
    published2019-05-14
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124868
    titlePhoton OS 1.0: Tar PHSA-2019-1.0-0228
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1856.NASL
    descriptionAccording to the version of the libseccomp package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.(CVE-2019-9893) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-08
    modified2019-09-17
    plugin id128908
    published2019-09-17
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128908
    titleEulerOS 2.0 SP2 : libseccomp (EulerOS-SA-2019-1856)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-1_0-0228_LIBSECCOMP.NASL
    descriptionAn update of the libseccomp package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id124865
    published2019-05-14
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124865
    titlePhoton OS 1.0: Libseccomp PHSA-2019-1.0-0228
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2283.NASL
    descriptionThis update for libseccomp fixes the following issues : Security issues fixed : - CVE-2019-9893: An incorrect generation of syscall filters in libseccomp was fixed (bsc#1128828) libseccomp was updated to new upstream release 2.4.1 : - Fix a BPF generation bug where the optimizer mistakenly identified duplicate BPF code blocks. libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893) : - Update the syscall table for Linux v5.0-rc5 - Added support for the SCMP_ACT_KILL_PROCESS action - Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute - Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension - Added support for the parisc and parisc64 architectures - Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3) - Return -EDOM on an endian mismatch when adding an architecture to a filter - Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run() - Fix PFC generation when a syscall is prioritized, but no rule exists - Numerous fixes to the seccomp-bpf filter generation code - Switch our internal hashing function to jhash/Lookup3 to MurmurHash3 - Numerous tests added to the included test suite, coverage now at ~92% - Update our Travis CI configuration to use Ubuntu 16.04 - Numerous documentation fixes and updates libseccomp was updated to release 2.3.3 : - Updated the syscall table for Linux v4.15-rc7 This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id129711
    published2019-10-08
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129711
    titleopenSUSE Security Update : libseccomp (openSUSE-2019-2283)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-3_0-0009_LIBSECCOMP.NASL
    descriptionAn update of the libseccomp package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id126376
    published2019-07-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126376
    titlePhoton OS 3.0: Libseccomp PHSA-2019-3.0-0009
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-2517-1.NASL
    descriptionThis update for libseccomp fixes the following issues : Security issues fixed : CVE-2019-9893: An incorrect generation of syscall filters in libseccomp was fixed (bsc#1128828) libseccomp was updated to new upstream release 2.4.1: Fix a BPF generation bug where the optimizer mistakenly identified duplicate BPF code blocks. libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893): Update the syscall table for Linux v5.0-rc5 Added support for the SCMP_ACT_KILL_PROCESS action Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension Added support for the parisc and parisc64 architectures Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3) Return -EDOM on an endian mismatch when adding an architecture to a filter Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run() Fix PFC generation when a syscall is prioritized, but no rule exists Numerous fixes to the seccomp-bpf filter generation code Switch our internal hashing function to jhash/Lookup3 to MurmurHash3 Numerous tests added to the included test suite, coverage now at ~92% Update our Travis CI configuration to use Ubuntu 16.04 Numerous documentation fixes and updates libseccomp was updated to release 2.3.3: Updated the syscall table for Linux v4.15-rc7 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id129555
    published2019-10-03
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129555
    titleSUSE SLED15 / SLES15 Security Update : libseccomp (SUSE-SU-2019:2517-1)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1956.NASL
    descriptionAccording to the version of the libseccomp package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.(CVE-2019-9893) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id128959
    published2019-09-17
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128959
    titleEulerOS Virtualization for ARM 64 3.0.2.0 : libseccomp (EulerOS-SA-2019-1956)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1794.NASL
    descriptionAccording to the version of the libseccomp package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.(CVE-2019-9893) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2019-08-23
    plugin id128086
    published2019-08-23
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128086
    titleEulerOS 2.0 SP5 : libseccomp (EulerOS-SA-2019-1794)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4001-2.NASL
    descriptionUSN-4001-1 fixed a vulnerability in libseccomp. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details : Jann Horn discovered that libseccomp did not correctly generate 64-bit syscall argument comparisons with arithmetic operators (LT, GT, LE, GE). An attacker could use this to bypass intended access restrictions for argument-filtered system calls. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id125625
    published2019-05-31
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125625
    titleUbuntu 14.04 LTS : libseccomp vulnerability (USN-4001-2)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-2941-1.NASL
    descriptionThis update for libseccomp fixes the following issues : Update to new upstream release 2.4.1 : Fix a BPF generation bug where the optimizer mistakenly identified duplicate BPF code blocks. Updated to 2.4.0 (bsc#1128828 CVE-2019-9893): Update the syscall table for Linux v5.0-rc5 Added support for the SCMP_ACT_KILL_PROCESS action Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension Added support for the parisc and parisc64 architectures Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3) Return -EDOM on an endian mismatch when adding an architecture to a filter Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run() Fix PFC generation when a syscall is prioritized, but no rule exists Numerous fixes to the seccomp-bpf filter generation code Switch our internal hashing function to jhash/Lookup3 to MurmurHash3 Numerous tests added to the included test suite, coverage now at ~92% Update our Travis CI configuration to use Ubuntu 16.04 Numerous documentation fixes and updates Update to release 2.3.3: Updated the syscall table for Linux v4.15-rc7 Update to release 2.3.2: Achieved full compliance with the CII Best Practices program Added Travis CI builds to the GitHub repository Added code coverage reporting with the
    last seen2020-06-01
    modified2020-06-02
    plugin id130945
    published2019-11-13
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130945
    titleSUSE SLED12 / SLES12 Security Update : libseccomp (SUSE-SU-2019:2941-1)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-1_0-0228_SQLITE.NASL
    descriptionAn update of the sqlite package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id124866
    published2019-05-14
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124866
    titlePhoton OS 1.0: Sqlite PHSA-2019-1.0-0228
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2280.NASL
    descriptionThis update for libseccomp fixes the following issues : Security issues fixed : - CVE-2019-9893: An incorrect generation of syscall filters in libseccomp was fixed (bsc#1128828) libseccomp was updated to new upstream release 2.4.1 : - Fix a BPF generation bug where the optimizer mistakenly identified duplicate BPF code blocks. libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893) : - Update the syscall table for Linux v5.0-rc5 - Added support for the SCMP_ACT_KILL_PROCESS action - Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute - Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension - Added support for the parisc and parisc64 architectures - Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3) - Return -EDOM on an endian mismatch when adding an architecture to a filter - Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run() - Fix PFC generation when a syscall is prioritized, but no rule exists - Numerous fixes to the seccomp-bpf filter generation code - Switch our internal hashing function to jhash/Lookup3 to MurmurHash3 - Numerous tests added to the included test suite, coverage now at ~92% - Update our Travis CI configuration to use Ubuntu 16.04 - Numerous documentation fixes and updates libseccomp was updated to release 2.3.3 : - Updated the syscall table for Linux v4.15-rc7 This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id129708
    published2019-10-08
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129708
    titleopenSUSE Security Update : libseccomp (openSUSE-2019-2280)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-1_0-0228_SYSTEMD.NASL
    descriptionAn update of the systemd package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id124867
    published2019-05-14
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124867
    titlePhoton OS 1.0: Systemd PHSA-2019-1.0-0228
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-3624.NASL
    descriptionAn update for libseccomp is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The libseccomp library provides an interface to the Linux Kernel
    last seen2020-06-01
    modified2020-06-02
    plugin id130560
    published2019-11-06
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130560
    titleRHEL 8 : libseccomp (RHSA-2019:3624)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201904-18.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201904-18 (libseccomp: Privilege escalation) Please review the CVE identifier referenced below for details. Impact : Please review the referenced CVE identifier for details. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id124131
    published2019-04-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124131
    titleGLSA-201904-18 : libseccomp: Privilege escalation

Redhat

advisories
bugzilla
id1690897
titleCVE-2019-9893 libseccomp: incorrect generation of syscall filters in libseccomp
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 8 is installed
      ovaloval:com.redhat.rhba:tst:20193384074
    • OR
      • AND
        • commentlibseccomp-debugsource is earlier than 0:2.4.1-1.el8
          ovaloval:com.redhat.rhsa:tst:20193624001
        • commentlibseccomp-debugsource is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20193624002
      • AND
        • commentlibseccomp is earlier than 0:2.4.1-1.el8
          ovaloval:com.redhat.rhsa:tst:20193624003
        • commentlibseccomp is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20193624004
      • AND
        • commentlibseccomp-devel is earlier than 0:2.4.1-1.el8
          ovaloval:com.redhat.rhsa:tst:20193624005
        • commentlibseccomp-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20193624006
rhsa
idRHSA-2019:3624
released2019-11-05
severityModerate
titleRHSA-2019:3624: libseccomp security, bug fix, and enhancement update (Moderate)
rpms
  • libseccomp-0:2.4.1-1.el8
  • libseccomp-debuginfo-0:2.4.1-1.el8
  • libseccomp-debugsource-0:2.4.1-1.el8
  • libseccomp-devel-0:2.4.1-1.el8
  • libseccomp-devel-debuginfo-0:2.4.1-1.el8

References