CVE-2019-19448 — Use After Free in Kernel

CWE-416 — Use After Free11 documents9 sources
Severity
7.8HIGHNVD
OSV5.5
EPSS
0.8%
top 26.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Linux KernelDebian LinuxCanonical Ubuntu Linux+1 more
Timeline
PublishedDec 8
Latest updateMay 24

Description

In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶NVDlinux/linux_kernel2.6.31 — 4.4.233+6
▶Debianlinux/linux_kernel< 5.7.17-1+3
▶Ubuntulinux/linux_kernel< 4.15.0-121.123
▶debiandebian/linux< linux 5.7.17-1 (bookworm)

Also affects: Debian Linux 9.0, Ubuntu Linux 14.04, 16.04, 18.04

🔴Vulnerability Details

4
GHSA
GHSA-55vw-8vf8-x898: In the Linux kernel 5↗2022-05-24
▶
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities↗2020-10-14
▶
Kernel
btrfs: only search for left_info if there is no right_info in try_merge_free_space↗2020-07-27
▶
OSV
CVE-2019-19448: In the Linux kernel 5↗2019-12-08
▶

📋Vendor Advisories

3
Ubuntu
Linux kernel vulnerabilities↗2020-10-14
▶
Red Hat
kernel: mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c↗2019-12-10
▶
Debian
CVE-2019-19448: linux - In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image...↗2019
▶

📄Research Papers

1
arXiv
MVD: Memory-Related Vulnerability Detection Based on Flow-Sensitive Graph Neural Networks↗2022-03-05
▶

💬Community

2
Bugzilla
CVE-2019-19448 kernel: mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free↗2019-12-10
▶
Bugzilla
CVE-2019-19448 kernel: mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free↗2019-12-10
▶