VDB

CVE-2019-17056

CVE-2019-17056 PUBLISHED

Reported by mitre · Published October 1, 2019

llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-3a359798b176.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
linux-hweUbuntu:16.04:LTS4.15.0-69.78~16.04.1
linux-awsUbuntu:16.04:LTS4.4.0-1098.109
linux-gke-4.15Ubuntu:18.04:LTS4.15.0-1048.51
linux-raspi2Ubuntu:16.04:LTS4.4.0-1125.134
linux-raspi2Ubuntu:18.04:LTS4.15.0-1050.54
linux-gcpUbuntu:16.04:LTS4.15.0-1049.52
linux-oracleUbuntu:16.04:LTS4.15.0-1029.32~16.04.1
linux-oemUbuntu:18.04:LTS4.15.0-1063.72
linux-awsUbuntu:Pro:14.04:LTS4.4.0-1058.62
linux-kvmUbuntu:18.04:LTS4.15.0-1050.50
linux-awsUbuntu:18.04:LTS4.15.0-1054.56
linux_kernellinux5.3.2

15 more packages have a fixed version. See every fix in Lookup.

Affected products

VendorProductVersions
n/an/an/a
n/an/a*

Timeline

  • Oct 1, 2019 CVE Published
  • Nov 14, 2019 CVE Updated
  • Apr 14, 2021 EPSS Score (30 in total, the first dated here)
  • Mar 6, 2026 Distribution Patch (5 in total, the first dated here)
  • Mar 6, 2026 Security Advisory (10 in total, the first dated here)
  • Sep 13, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2019-17056
vulnetix vdb fixes CVE-2019-17056

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2019-17056/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›