CVE-2024-5290
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root). Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
wpa_supplicant
- Vendor
- Canonical Ltd.
- Product
- wpa_supplicant
- Platforms
- Linux
- Default status
unaffected- Package
- wpa
- Package collection
- https://launchpad.net/ubuntu/+source/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2:2.10-15 | affected | semver | 2:2.10-21ubuntu0.1 | Unavailable | None listed |
| 2:2.9.0-21build1 | affected | semver | 2:2.10-6ubuntu2.1 | Unavailable | None listed |
| 2:2.9-1ubuntu2 | affected | semver | 2:2.9-1ubuntu4.4 | Unavailable | None listed |
| 2.4-0ubuntu10 | affected | semver | 2:2.6-15ubuntu2.8+esm1 | Unavailable | None listed |
| 2.4-0ubuntu3 | affected | semver | 2.4-0ubuntu6.8+esm1 | Unavailable | None listed |
| 2.1-0ubuntu1 | affected | semver | 2.1-0ubuntu1.7+esm5 | Unavailable | None listed |