Lucene search

K
ubuntucveUbuntu.comUB:CVE-2019-19770
HistoryDec 12, 2019 - 12:00 a.m.

CVE-2019-19770

2019-12-1200:00:00
ubuntu.com
ubuntu.com
23

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

0.002 Low

EPSS

Percentile

60.4%

DISPUTED In the Linux kernel 4.19.83, there is a use-after-free
(read) in the debugfs_remove function in fs/debugfs/inode.c (which is used
to remove a file or directory in debugfs that was previously created with a
call to another debugfs function such as debugfs_create_file). NOTE: Linux
kernel developers dispute this issue as not being an issue with debugfs,
instead this is an issue with misuse of debugfs within blktrace.

Bugs

Notes

Author Note
sbeattie reproducer in github link according to kernel maintainer, needed commits are: (1b0b28364816) blktrace: break out of blktrace setup on concurrent calls (c3dbe541ef77) blktrace: Avoid sparse warnings when assigning q->blk_trace (a67549c8e568) blktrace: annotate required lock on do_blk_trace_setup() (bad8e64fb19d) blktrace: fix debugfs use after free (b431ef837e33) blktrace: ensure our debugfs dir exists
OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< 4.15.0-129.132UNKNOWN
ubuntu20.04noarchlinux< 5.4.0-51.56UNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1091.96UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1028.29UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< 5.4.0-1028.29~18.04.1UNKNOWN
ubuntu16.04noarchlinux-aws-hwe< 4.15.0-1091.96~16.04.1UNKNOWN
ubuntu20.04noarchlinux-azure< 5.4.0-1031.32UNKNOWN
ubuntu14.04noarchlinux-azure< 4.15.0-1103.114~14.04.1) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN
ubuntu16.04noarchlinux-azure< 4.15.0-1103.114~16.04.1UNKNOWN
ubuntu18.04noarchlinux-azure-4.15< 4.15.0-1103.114UNKNOWN
Rows per page:
1-10 of 361

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

0.002 Low

EPSS

Percentile

60.4%