CVE-2019-19241

In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORING_OP_SENDMSG operations, although requested in the context of an unprivileged user, are sometimes performed by a kernel worker thread without considering that context.

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1975Mailing List, Third Party Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2Mailing List, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=181e448d8709e517c9c7b523fcd209f24eb38ca7Patch, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d69e07793f891524c6bbf1e75b9ae69db4450953Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20200103-0001/
• https://usn.ubuntu.com/4284-1/
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1975Mailing List, Third Party Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2Mailing List, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=181e448d8709e517c9c7b523fcd209f24eb38ca7Patch, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d69e07793f891524c6bbf1e75b9ae69db4450953Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20200103-0001/
• https://usn.ubuntu.com/4284-1/

Published

Dec 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19231An insecure file access vulnerability exists in CA Client Au…7.8
• CVE-2019-19232In Sudo through 1.8.29, an attacker with access to a Runas A…7.5
• CVE-2019-19234In Sudo through 1.8.29, the fact that a user has been blocke…7.5
• CVE-2019-19235AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 (for Windo…7
• CVE-2019-1924Multiple vulnerabilities in Cisco Webex Network Recording Pl…7.8
• CVE-2019-19240Embedthis GoAhead before 5.0.1 mishandles redirected HTTP re…5.3
• CVE-2019-19242SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by t…5.9
• CVE-2019-19244sqlite3Select in select.c in SQLite 3.30.1 allows a crash if…7.5
• CVE-2019-19245NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authen…9.8
• CVE-2019-19246Oniguruma through 6.9.3, as used in PHP 7.3.x and other prod…7.5
• CVE-2019-19247Electronic Arts Origin through 10.5.x allows Elevation of Pr…7.8
• CVE-2019-19248Electronic Arts Origin through 10.5.x allows Elevation of Pr…7.8