Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 2 products
Getting root on Ubuntu through wishful thinking https://securitylab.github.com/research//ubuntu-accountsservice-CVE-2021-3939/
Post summary
The tweet shares a link to a GitHub Security Lab research article demonstrating a root privilege exploit for CVE-2021-3939 on Ubuntu, indicating a PoC.
Getting root on Ubuntu through wishful thinking https://securitylab.github.com/research/ubuntu-accountsservice-CVE-2021-3939/
Post summary
The tweet shares a GitHub Security Lab research link for CVE-2021-3939 and highlights root access on Ubuntu, but lacks explicit PoC, exploit tool, active-exploitation, or patch details.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | canonical | accountsservice | - | - | - |
| OS | canonical | ubuntu_linux | 20.04 | - | - |
| OS | canonical | ubuntu_linux | 21.04 | - | - |
| OS | canonical | ubuntu_linux | 21.10 | - | - |