XMB5/zsh-privileged-upgrade

XMB5/zsh-privileged-upgrade

GitHubGitHub
GitHubgithub.com
Releases0
ZSH Exploit allowing a user to restore privileges dropped from --no-PRIVILEGED option
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2019-20044↗
7.8 HIGH7.2 HIGH

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().