Cloudanix VulnDB

CVE-2024-5290

High · 8.8

CVSS

8.8

EPSS

0.7%

Published

Aug 7, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A local user with limited network permissions can make a background system service load malicious code, giving that user full control of the computer.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Privilege Escalation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Allows a local unprivileged attacker with netdev group membership or dbus access to specify an arbitrary path to a shared object that wpa_supplicant loads, resulting in execution of attacker-controlled code with the privileges of the wpa_supplicant process (typically root).

Why it matters to the business

Local attackers can obtain root-level control on affected systems, enabling complete system compromise, persistence, or lateral movement. The issue affects widely deployed AlmaLinux bcc packages, increasing exposure across enterprise Linux environments until patched.

How an attack unfolds

An attacker on a system with wpa_supplicant running joins the netdev group or obtains dbus access, then supplies a malicious shared object path. wpa_supplicant loads the object, executing the attacker's code as root and granting full privilege escalation.

How to fix it

Upgrade affected bcc packages on AlmaLinux 8 to version 0.19.0-4.el8 or later. Remove unnecessary netdev group memberships and restrict dbus access to wpa_supplicant where possible until patches are applied.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases (bcc 0.19.0-4.el8 and related subpackages). Confirm that the vulnerable code paths for arbitrary module loading are no longer reachable after the update.

Typical attack path

  1. Obtain local unprivileged access and netdev group membership or dbus interface access
  2. Identify the running wpa_supplicant process and its configuration interface
  3. Craft and place a malicious shared object on the filesystem
  4. Instruct wpa_supplicant via the allowed interface to load the attacker-chosen path
  5. Execute arbitrary code with root privileges

How to detect it

Review system logs for wpa_supplicant process loading unexpected shared objects from non-standard paths; examine dbus or netdev-related authentication events preceding unusual process behavior.

What your security team should do

  • Immediately apply the listed package updates on all AlmaLinux 8 systems using bcc
  • Audit netdev group membership and dbus permissions for wpa_supplicant across the fleet
  • Monitor for any post-patch anomalies in wpa_supplicant process behavior

The record

An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root). Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard wpa_supplicant 0 2.11-r1
Debian:11 wpa 0 2:2.9.0-21+deb11u2
Debian:12 wpa 0 2:2.10-12+deb12u2
Debian:13 wpa 0 2:2.10-22
Ubuntu:14.04:LTS wpa 0 2.1-0ubuntu1.7+esm5
Ubuntu:16.04:LTS wpa 0 2.4-0ubuntu6.8+esm1
Ubuntu:18.04:LTS wpa 0 2:2.6-15ubuntu2.8+esm1
Ubuntu:20.04:LTS wpa 0 2:2.9-1ubuntu4.4
Ubuntu:22.04:LTS wpa 0 2:2.10-6ubuntu2.1
Ubuntu:24.04:LTS wpa 0 2:2.10-21ubuntu0.1

Related vulnerabilities