Every CVE Search/ Get API key

CVE-2019-18276

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By...

7.8 HighPublic exploitFix available

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.61%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Record
CVE-2019-18276
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-273
Updated
2026-11-02
CVE List 7.8

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Record
CVE-2019-18276
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-273
Updated
2026-11-02
EUVDEUVD-2019-8065 7.8

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Record
EUVD-2019-8065
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-jcxc-5f87-vq5m 7.8

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By...

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Record
GHSA-jcxc-5f87-vq5m
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-273
Updated
2026-11-02
OSVBELL-CVE-2019-18276 7.8

CVE-2019-18276 does not affect BellSoft software

Record
BELL-CVE-2019-18276
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Record
CVE-2019-18276
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2019-18276 7.8

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Record
DEBIAN-CVE-2019-18276
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:1679 7.8

Red Hat Security Advisory: bash security and bug fix update

Record
RHSA-2021:1679
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-18276 7.8

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Record
UBUNTU-CVE-2019-18276
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2022-1650909007 No score

Fixed CVE-2019-18276 in bash

  • CVE-2019-18276: Fix priviledge dropping when running with effective UID not equal to real UID
Record
CLSA-2022-1650909007
Updated
2026-11-02
OSVCLSA-2022-1650910003 No score

Fix of CVE: CVE-2019-18276

  • CVE-2019-18276: Fix priviledge dropping when running with effective UID not equal to real UID
Record
CLSA-2022-1650910003
Updated
2026-11-02
OSVCLSA-2022-1651685129 No score

Fix CVE(s): CVE-2019-18276

  • SECURITY UPDATE: privilege gain via setuid
    • debian/patches/CVE-2019-18276.patch: replace the use of setuid and setgid when possible with setresuid and setresgid, respectively.
    • CVE-2019-18276
Record
CLSA-2022-1651685129
Updated
2026-11-02
OSVCLSA-2025-1761326171 No score

Fix CVE(s): CVE-2019-18276

  • SECURITY UPDATE: privilege escalation vulnerability in privileged mode
    • debian/patches/CVE-2019-18276.patch: fix setuid/setgid handling when bash is running in privileged mode, use setresuid/setresgid over setuid/setgid when available
    • CVE-2019-18276
Record
CLSA-2025-1761326171
Updated
2026-11-02
OSVMGASA-2021-0288 No score

Updated bash packages fix a security vulnerability

A privilege escalation vulnerability was found in bash in the way it dropped privileges when started with an effective user id not equal to the real user id. Bash may be vulnerable to this flaw if the setuid permission is set and the owner of the bash program itself is a non-root user. A local attacker could exploit this flaw to escalate their privileges on the system (CVE-2019-18276).

Record
MGASA-2021-0288
Updated
2026-11-02
OSVUSN-5380-1 No score

bash vulnerability

It was discovered that Bash did not properly drop privileges when the binary had the setuid bit enabled. An attacker could possibly use this issue to escalate privileges.

Record
USN-5380-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bash
TuxCare:OracleLinux:6
 before 4.1.2-48.el6.tuxcare.els1
4.1.2-48.el6.tuxcare.els1
bash-doc
TuxCare:OracleLinux:6
 before 4.1.2-48.el6.tuxcare.els1
4.1.2-48.el6.tuxcare.els1
bash
TuxCare:CentOS:6
 before 4.1.2-48.el6.tuxcare.els1
4.1.2-48.el6.tuxcare.els1
bash-doc
TuxCare:CentOS:6
 before 4.1.2-48.el6.tuxcare.els1
4.1.2-48.el6.tuxcare.els1
bash
TuxCare:Ubuntu:16.04
 before 4.3-14ubuntu1.4+tuxcare.els1
4.3-14ubuntu1.4+tuxcare.els1
bash-builtins
TuxCare:Ubuntu:16.04
 before 4.3-14ubuntu1.4+tuxcare.els1
4.3-14ubuntu1.4+tuxcare.els1
bash-doc
TuxCare:Ubuntu:16.04
 before 4.3-14ubuntu1.4+tuxcare.els1
4.3-14ubuntu1.4+tuxcare.els1
bash-static
TuxCare:Ubuntu:16.04
 before 4.3-14ubuntu1.4+tuxcare.els1
4.3-14ubuntu1.4+tuxcare.els1
bash
TuxCare:Debian:10
 before 5.0-4+tuxcare.els1
5.0-4+tuxcare.els1
bash-builtins
TuxCare:Debian:10
 before 5.0-4+tuxcare.els1
5.0-4+tuxcare.els1
Show 14 moreShow less
Affected packages
PackageAffectedFixed
bash-doc
TuxCare:Debian:10
 before 5.0-4+tuxcare.els1
5.0-4+tuxcare.els1
bash-static
TuxCare:Debian:10
 before 5.0-4+tuxcare.els1
5.0-4+tuxcare.els1
bash
Debian:12
 before 5.1~rc1-2
5.1~rc1-2
bash
Debian:13
 before 5.1~rc1-2
5.1~rc1-2
bash
Debian:14
 before 5.1~rc1-2
5.1~rc1-2
bash
Mageia:7
 before 4.4-23.1.2.mga7
4.4-23.1.2.mga7
bash
Red Hat:enterprise_linux:8::baseos
 before 0:4.4.19-14.el8
0:4.4.19-14.el8
bash-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:4.4.19-14.el8
0:4.4.19-14.el8
bash-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:4.4.19-14.el8
0:4.4.19-14.el8
bash-doc
Red Hat:enterprise_linux:8::baseos
 before 0:4.4.19-14.el8
0:4.4.19-14.el8
bash
Ubuntu:Pro:14.04:LTS
 before 4.3-7ubuntu1.8+esm2, plus listed versions
4.2-5ubuntu34.3-1ubuntu24.3-2ubuntu14.3-3ubuntu14.3-4ubuntu1
Show 12 moreShow less
4.3-4ubuntu24.3-6ubuntu14.3-7ubuntu14.3-7ubuntu1.14.3-7ubuntu1.24.3-7ubuntu1.34.3-7ubuntu1.44.3-7ubuntu1.54.3-7ubuntu1.64.3-7ubuntu1.74.3-7ubuntu1.84.3-7ubuntu1.8+esm1
4.3-7ubuntu1.8+esm2
bash
Ubuntu:Pro:16.04:LTS
 before 4.3-14ubuntu1.4+esm1, plus listed versions
4.3-14ubuntu14.3-14ubuntu1.14.3-14ubuntu1.24.3-14ubuntu1.34.3-14ubuntu1.4
4.3-14ubuntu1.4+esm1
bash
Ubuntu:18.04:LTS
 before 4.4.18-2ubuntu1.3, plus listed versions
4.4-5ubuntu14.4.18-1ubuntu14.4.18-2ubuntu14.4.18-2ubuntu1.14.4.18-2ubuntu1.2
4.4.18-2ubuntu1.3
bash
Ubuntu:20.04:LTS
 before 5.0-6ubuntu1.2, plus listed versions
5.0-4ubuntu15.0-5ubuntu15.0-6ubuntu15.0-6ubuntu1.1
5.0-6ubuntu1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubM-ensimag/CVE-2019-182762021-12-09
PoC in GitHubSABI-Ensimag/CVE-2019-182762022-01-12

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-18276 is a high vulnerability (CVSS 7.8) in Gnu Bash, published November 28, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.61%, the 85th percentile. Fixed in bash 4.1.2-48.el6.tuxcare.els1.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open