CVE-2019-15919
published 2019-09-04CVE-2019-15919: An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.
PriorityP412low3.3CVSS 3.1
AVLACLPRLUINSUCLINAN
EPSS
0.43%
35.8th percentile
An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.19.37-1 (bookworm) | linux 4.19.37-1 (bookworm) |
| linux | linux_kernel | < 5.0.10 | 5.0.10 |
| linux | linux_kernel | >= 0 < 4.19.37-1 | 4.19.37-1 |
| linux | linux_kernel | >= 0 < 4.19.37-1 | 4.19.37-1 |
| linux | linux_kernel | >= 0 < 4.19.37-1 | 4.19.37-1 |
| linux | linux_kernel | >= 0 < 4.19.37-1 | 4.19.37-1 |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv3.3LOW
vendor_debian3.3LOW
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: use-after-free in SMB2_write function in fs/cifs/smb2pdu.c
vendor_redhat·2019-09-04·CVSS 3.3
CVE-2019-15919 [LOW] CWE-416 kernel: use-after-free in SMB2_write function in fs/cifs/smb2pdu.c
kernel: use-after-free in SMB2_write function in fs/cifs/smb2pdu.c
An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.
An flaw was discovered in the Linux kernel's CIFS client implementation. While issuing an SMB2_write, a value can be used after it was intended to be freed when CIFS function tracing is enabled. Even though the data is used after being freed, using it to for privilege escalation does not seem possible.
Mitigation: As the CIFS module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions:
# echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf
The system will need to be restarted if the CIFS modules are loaded. In most circum
Debian
CVE-2019-15919: linux - An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs...
vendor_debian·2019·CVSS 3.3
CVE-2019-15919 [LOW] CVE-2019-15919: linux - An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs...
An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.
Scope: local
bookworm: resolved (fixed in 4.19.37-1)
bullseye: resolved (fixed in 4.19.37-1)
forky: resolved (fixed in 4.19.37-1)
sid: resolved (fixed in 4.19.37-1)
trixie: resolved (fixed in 4.19.37-1)
GHSA
GHSA-m3c6-89vg-9rwq: An issue was discovered in the Linux kernel before 5
ghsa_unreviewed·2022-05-24
CVE-2019-15919 [LOW] GHSA-m3c6-89vg-9rwq: An issue was discovered in the Linux kernel before 5
An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.
OSV
CVE-2019-15919: An issue was discovered in the Linux kernel before 5
osv·2019-09-04·CVSS 3.3
CVE-2019-15919 [LOW] CVE-2019-15919: An issue was discovered in the Linux kernel before 5
An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-15919 kernel: use-after-free in SMB2_write function in fs/cifs/smb2pdu.c
bugzilla·2019-09-09·CVSS 3.3
CVE-2019-15919 [LOW] CVE-2019-15919 kernel: use-after-free in SMB2_write function in fs/cifs/smb2pdu.c
CVE-2019-15919 kernel: use-after-free in SMB2_write function in fs/cifs/smb2pdu.c
An issue was discovered in the Linux kernels CIFS client implementation.
While issuing an SMB2_write a value can be used after it was intended to be freed when CIFS function tracing is enabled.
While no privilege escalation is immediately obvious, Red Hat will not rule out that it may be possible.
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1750411]
---
Upstream Issue:
https://github.com/torvalds/linux/commit/6a3eb3360667170988f8a6477f6686242061488a
---
This was fixed for Fedora with the 5.0.10 stable kernel updates.
---
So, taking a look at the context of this apparent UAF.
rc = cifs_send_recv(xid, io_parms->tcon->ses, &rqst,
&resp_buftype, flags, &rsp_iov);
Bugzilla
CVE-2019-15919 kernel: use-after-free in SMB2_write function in fs/cifs/smb2pdu.c [fedora-all]
bugzilla·2019-09-09·CVSS 3.3
CVE-2019-15919 [LOW] CVE-2019-15919 kernel: use-after-free in SMB2_write function in fs/cifs/smb2pdu.c [fedora-all]
CVE-2019-15919 kernel: use-after-free in SMB2_write function in fs/cifs/smb2pdu.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple s
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlhttps://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.10https://github.com/torvalds/linux/commit/6a3eb3360667170988f8a6477f6686242061488ahttps://security.netapp.com/advisory/ntap-20191004-0001/http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlhttps://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.10https://github.com/torvalds/linux/commit/6a3eb3360667170988f8a6477f6686242061488ahttps://security.netapp.com/advisory/ntap-20191004-0001/
2019-09-04
Published