ZeroDay Findings
Sign inSign up

Findings

CVE-2019-18276

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11.

Published Nov 28, 2019 · updated Oct 14, 2026 · gnu bash

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 28, 2019 · NIST NVD

    Detected

    An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command executio

  2. Oct 14, 2026 · NIST NVD

    Updated

    An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command executio

Affected

  • cpe gnu/bashversion unspecified
  • cpe gnu/bash5.0
  • cpe netapp/hci management nodeversion unspecified
  • cpe oracle/communications cloud native core policy1.14.0

Sources

  • CVE.orgCVE-2019-18276

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-18276

    30-day exploitation probability 2.6%

    first.org
  • NIST NVDCVE-2019-18276

    An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux a

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References