LiveActive security incident?Get immediate response
CVE Record

CVE-2019-15793: Mishandling of file-system uid/gid with namespaces in shiftfs

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into init_user_ns, whereas they should have been translated into the s_user_ns for the lower filesystem. This resulted in using ids other than the intended ones in the lower fs, which likely did not map into the shifts s_user_ns. A local attacker could use this to possibly bypass discretionary access control permissions.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a local Ubuntu kernel issue in shiftfs. A logged-in attacker could potentially make filesystem permission checks use the wrong user or group identity, possibly exposing protected data. The source bundle does not show remote exploitation or active abuse.

Executive priority

Treat as a moderate-priority Linux fleet issue. It is not shown as remotely exploitable, but affected multi-user or container-oriented hosts deserve timely kernel updates because confidentiality impact may be high.

Technical view

Shiftfs translated user and group IDs into init_user_ns instead of the lower filesystem s_user_ns before lower-filesystem operations. That namespace mismatch could cause unintended IDs to be used for discretionary access control decisions, possibly bypassing read permissions.

Likely exposure

Exposure appears limited to Ubuntu systems running affected 5.0 or 5.3 kernel series with shiftfs present and relevant namespace/lower-filesystem use.

Exploitation context

The CVSS vector is local, low complexity, low privileges, no user interaction, scope changed, and high confidentiality impact. KEV is false in the source bundle, so active exploitation is not established.

Researcher notes

The key bug is incorrect uid/gid namespace translation before lower-filesystem operations. Evidence does not include proof-of-concept details, exploitation reports, or exact fixed package versions beyond Ubuntu advisories and the referenced Launchpad commit.

Mitigation direction

  • Apply Ubuntu kernel updates referenced by USN-4183-1 and USN-4184-1.
  • Prioritize hosts using affected Ubuntu 5.0 or 5.3 kernels.
  • Check vendor guidance before changing shiftfs or namespace configurations.
  • Limit local shell access on affected hosts until updated.

Validation and detection

  • Inventory Ubuntu hosts for 5.0 and 5.3 kernel series.
  • Confirm whether shiftfs is present or used on candidate hosts.
  • Verify installed kernel packages against Ubuntu USN-4183-1 and USN-4184-1.
  • Review local-access paths for untrusted users on affected systems.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-538: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-15793 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N24Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2019-15793Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
UbuntuShiftfs in the Linux kernel5.3.0-11.12, 5.0 kernelListed
Weakness

CWE details

CWE-538

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.