CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19241 – Linux 5.3 - Privilege Escalation via io_uring Offload of sendmsg() onto Kernel Thread with Kernel Creds
https://notcve.org/view.php?id=CVE-2019-19241
In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORING_OP_SENDMSG operations, although requested in the context of an unprivileged user, are sometimes performed by a kernel worker thread without considering that context. En el kernel de Linux versiones anteriores a la versión 5.4.2, la característica io_uring genera peticiones que inadvertidamente tienen UID 0 y capacidades completas, también se conoce como CID-181e448d8709. • https://www.exploit-db.com/exploits/47779 https://bugs.chromium.org/p/project-zero/issues/detail?id=1975 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=181e448d8709e517c9c7b523fcd209f24eb38ca7 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d69e07793f891524c6bbf1e75b9ae69db4450953 https://security.netapp.com/advisory/ntap-20200103-0001 https://usn.ubuntu.com/4284-1 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19767 – kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c and fs/ext4/super.c
https://notcve.org/view.php?id=CVE-2019-19767
The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163. El kernel de Linux versión anterior a 5.4.2 maneja inapropiadamente la función ext4_expand_extra_isize, como es demostrado por un error de uso de la memoria previamente liberada en las funciones __ext4_expand_extra_isize y ext4_xattr_set_entry, relacionadas con los archivos fs/ext4/inode.c y fs/ext4/super.c, también se conoce como CID-4ea99936a163. A use-after-free flaw was found in the Linux kernel’s ext4 file system functionality when the user mount ext4 partition, with the usage of an additional debug parameter is defining an extra inode size. If this parameter has a non zero value, this flaw allows a local user to crash the system when inode expansion happens. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html https://bugzilla.kernel.org/show_bug.cgi?id=205609 https://bugzilla.kernel.org/show_bug.cgi?id=205707 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a https://github.com/torvalds/linux/commit/4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html h • CWE-416: Use After Free •
CVSS: 6.7EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19769
https://notcve.org/view.php?id=CVE-2019-19769
In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h). En el kernel de Linux versión 5.3.10, se presenta un uso de la memoria previamente liberada en la función perf_trace_lock_acquire (relacionada con el archivo include/trace/events/lock.h). • https://bugzilla.kernel.org/show_bug.cgi?id=205705 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF4PQZBEPNXDSK5DOBMW54OCLP25FTCD https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJSIZWKW7RDHKU3CHC5BFAQI43NVHLUQ https://security.netapp.com/advisory/ntap-20200103-0001 https://usn.ubuntu.com/4368-1 https://usn.ubuntu.com/4369-1 • CWE-416: Use After Free •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19770 – kernel: use-after-free in debugfs_remove in fs/debugfs/inode.c
https://notcve.org/view.php?id=CVE-2019-19770
In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of debugfs within blktrace ** EN DISPUTA ** En el kernel de Linux versión 4.19.83, presenta un uso de la memoria previamente liberada en la función debugfs_remove en el archivo fs/debugfs/inode.c (que se usa para eliminar un archivo o directorio en debugfs que se creó previamente con una llamada a otra función debugfs como debugfs_create_file). NOTA: Los desarrolladores del kernel de Linux disputan este problema como no un problema con debugfs, sino que es un problema con el mal uso de debugfs dentro de blktrace. A use-after-free flaw was found in the debugfs_remove function in the Linux kernel. The flaw could allow a local attacker with special user (or root) privilege to crash the system at the time of file or directory removal. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html https://bugzilla.kernel.org/show_bug.cgi?id=205713 https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html https://lore.kernel.org/linux-block/20200402000002.7442-1-mcgrof%40kernel.org https://security.netapp.com/advisory/ntap-20200103-0001 https://access.redhat.com/security/cve/CVE-2019-19770 https://bugzilla.redhat.com/show_bug.cgi?id=1786179 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 35EXPL: 1CVE-2019-19448
https://notcve.org/view.php?id=CVE-2019-19448
In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure. En el kernel de Linux versiones 5.0.21 y 5.3.11, montando una imagen de sistema de archivos btrfs diseñada, al realizar algunas operaciones y luego haciendo una llamada de sistema syncfs puede conllevar a un uso de la memoria previamente liberada en la función try_merge_free_space en el archivo fs/btrfs/free-space-cache.c porque el puntero en una estructura de datos izquierda puede ser el mismo que el puntero en una estructura de datos derecha. • https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19448 https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html https://security.netapp.com/advisory/ntap-20200103-0001 https://usn.ubuntu.com/4578-1 • CWE-416: Use After Free •