« Volver al listado

CVE-2026-102371

Estado: Pendiente de análisisMedia (5.7)—

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On systems where /proc is mounted without process-hiding mitigations (such as hidepid), which is the default in WSL, an unprivileged local user or process in the same WSL instance can read the token from /proc/<pid>/cmdline while the attach process is running. The leaked token could then be used to attach other machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector AV:L/PR:L permite escalada local (T1068). El texto describe lectura de cmdline en /proc por usuario sin privilegios (T1552.001: credenciales en procesos). Token reutilizable (T1078.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingThreat Intelligence ProgramRestrict File and Directory PermissionsPassword PoliciesExecution PreventionAudit

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Canonical — WSL PRO ServiceAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-102371",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-102371",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-30T15:17:31.871369Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@ubuntu.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "repo": "https://github.com/canonical/ubuntu-pro-for-wsl",
          "vendor": "Canonical",
          "product": "Ubuntu Pro for WSL",
          "versions": [
            {
              "status": "affected",
              "version": "0.1.1",
              "lessThan": "0.1.19ubuntu2",
              "versionType": "ubuntu-resolute"
            },
            {
              "status": "affected",
              "version": "0.1.1",
              "lessThan": "0.1.18~24.04.3",
              "versionType": "ubuntu-noble"
            },
            {
              "status": "affected",
              "version": "0.1.1",
              "lessThan": "0.1.18~22.04.2",
              "versionType": "ubuntu-jammy"
            },
            {
              "status": "affected",
              "version": "0.1.1",
              "lessThan": "0.1.18~20.04.2",
              "versionType": "ubuntu-focal"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "packageName": "wsl-pro-service",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-29T15:17:17.557",
  "references": [
    {
      "url": "https://github.com/canonical/ubuntu-pro-for-wsl/commit/11c164a37b806bcf2a2304beb0d65e406739778b",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://github.com/canonical/ubuntu-pro-for-wsl/pull/1816",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://ubuntu.com/security/CVE-2026-102371",
      "source": "security@ubuntu.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@ubuntu.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-214"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On systems where /proc is mounted without process-hiding mitigations (such as hidepid), which is the default in WSL, an unprivileged local user or process in the same WSL instance can read the token from /proc/<pid>/cmdline while the attach process is running. The leaked token could then be used to attach other machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services."
    }
  ],
  "lastModified": "2026-09-30T16:17:06.147",
  "sourceIdentifier": "security@ubuntu.com"
}