CVE-2019-19318
published 2019-11-28CVE-2019-19318: In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in…
PriorityP417medium4.4CVSS 3.1
AVLACLPRHUINSUCNINAH
EPSS
0.65%
45.9th percentile
In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer,
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 5.4.6-1 (bookworm) | linux 5.4.6-1 (bookworm) |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.4.6-1 | 5.4.6-1 |
| linux | linux_kernel | >= 0 < 5.4.6-1 | 5.4.6-1 |
| linux | linux_kernel | >= 0 < 5.4.6-1 | 5.4.6-1 |
| linux | linux_kernel | >= 0 < 5.4.6-1 | 5.4.6-1 |
| linux | linux_kernel | >= 0 < 4.15.0-109.110 | 4.15.0-109.110 |
| netapp | active_iq_unified_manager | >= 9.5 | — |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
osv4.4MEDIUM
vendor_debian4.4MEDIUM
vendor_redhat4.4MEDIUM
vendor_ubuntu4.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r6gp-mqm3-8pv6: In the Linux kernel 5
ghsa_unreviewed·2022-05-24
CVE-2019-19318 [MEDIUM] CWE-416 GHSA-r6gp-mqm3-8pv6: In the Linux kernel 5
In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer,
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2020-07-06·CVSS 4.1
CVE-2019-16089 [MEDIUM] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the network block device (nbd) implementation in the
Linux kernel did not properly check for error conditions in some
situations. An attacker could possibly use this to cause a denial of service
(system crash). (CVE-2019-16089)
It was discovered that the btrfs file system implementation in the Linux
kernel did not properly validate file system metadata in some situations.
An attacker could use this to construct a malicious btrfs image that, when
mounted, could cause a denial of service (system crash). (CVE-2019-19036,
CVE-2019-19318, CVE-2019-19813, CVE-2019-19816)
I
OSV
CVE-2019-19318: In the Linux kernel 5
osv·2019-11-28·CVSS 4.4
CVE-2019-19318 [MEDIUM] CVE-2019-19318: In the Linux kernel 5
In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer,
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-07-06·CVSS 4.1
CVE-2019-19318 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the network block device (nbd) implementation in the
Linux kernel did not properly check for error conditions in some
situations. An attacker could possibly use this to cause a denial of service
(system crash). (CVE-2019-16089)
It was discovered that the btrfs file system implementation in the Linux
kernel did not properly validate file system metadata in some situations.
An attacker could use this to construct a malicious btrfs image that, when
mounted, could cause a denial of service (system crash). (CVE-2019-19036,
CVE-2019-19318, CVE-2019-19813, CVE-2019-19816)
It was discovered that the btrfs implementation in the Linux kernel did not
properly detect that a b
Red Hat
kernel: use-after-free in rwsem_down_write_slowpath in kernel/locking/rwsem.c
vendor_redhat·2019-11-28·CVSS 4.4
CVE-2019-19318 [MEDIUM] CWE-416 kernel: use-after-free in rwsem_down_write_slowpath in kernel/locking/rwsem.c
kernel: use-after-free in rwsem_down_write_slowpath in kernel/locking/rwsem.c
In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer,
A use-after-free flaw was found in rwsem_can_spin_on_owner in the kernel/locking/rwsem.c function in the Linux kernel’s synchronization mechanism. This flaw allows a local attacker with root privileges to cause a denial of service. This vulnerability could also lead to a kernel information leak issue.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deploymen
Debian
CVE-2019-19318: linux - In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rw...
vendor_debian·2019·CVSS 4.4
CVE-2019-19318 [MEDIUM] CVE-2019-19318: linux - In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rw...
In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer,
Scope: local
bookworm: resolved (fixed in 5.4.6-1)
bullseye: resolved (fixed in 5.4.6-1)
forky: resolved (fixed in 5.4.6-1)
sid: resolved (fixed in 5.4.6-1)
trixie: resolved (fixed in 5.4.6-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-19318 kernel: use-after-free in rwsem_down_write_slowpath in kernel/locking/rwsem.c [fedora-all]
bugzilla·2019-12-16·CVSS 4.4
CVE-2019-19318 [MEDIUM] CVE-2019-19318 kernel: use-after-free in rwsem_down_write_slowpath in kernel/locking/rwsem.c [fedora-all]
CVE-2019-19318 kernel: use-after-free in rwsem_down_write_slowpath in kernel/locking/rwsem.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2019-19318 kernel: use-after-free in rwsem_down_write_slowpath in kernel/locking/rwsem.c
bugzilla·2019-12-16·CVSS 4.4
CVE-2019-19318 [MEDIUM] CVE-2019-19318 kernel: use-after-free in rwsem_down_write_slowpath in kernel/locking/rwsem.c
CVE-2019-19318 kernel: use-after-free in rwsem_down_write_slowpath in kernel/locking/rwsem.c
A use-after-free flaw was found in rwsem_can_spin_on_owner in kernel/locking/rwsem.c in Linux kernel synchronization mechanism. This flaw can allow a local attacker with root privilege to cause a denial of service (DoS). This vulnerability could even lead to a kernel information leak problem.
For writer, the owner value is cleared on unlock. For reader, it is left intact on unlock for providing better debugging aid on crash dump and the unlock of one reader may not mean the lock is free.
As a result, the owner_on_cpu() shouldn't be used on read-owner as the task pointer value may not be valid and the task structure might have been freed. That is the case in rwsem_can_spin_on_owner() where the fo
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.htmlhttps://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19318https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlhttps://security.netapp.com/advisory/ntap-20200103-0001/https://usn.ubuntu.com/4414-1/http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.htmlhttps://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19318https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlhttps://security.netapp.com/advisory/ntap-20200103-0001/https://usn.ubuntu.com/4414-1/
2019-11-28
Published