CVSS: 7.1EPSS: 0%CPEs: 20EXPL: 1CVE-2019-19813
https://notcve.org/view.php?id=CVE-2019-19813
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c. This is related to mutex_can_spin_on_owner in kernel/locking/mutex.c, __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and btrfs_insert_delayed_items in fs/btrfs/delayed-inode.c. En el kernel de Linux versión 5.0.21, montar una imagen de sistema de archivos btrfs especialmente diseñada, realizar algunas operaciones y luego hacer una llamada al sistema syncfs puede conllevar a un uso de la memoria previamente liberada en la función __mutex_lock en el archivo kernel/lock/mutex.c. Esto está relacionado con la función mutex_can_spin_on_owner en el archivo kernel/lock/mutex.c, la función __btrfs_qgroup_free_meta en el archivo fs/btrfs/qgroup.c y la función btrfs_insert_delayed_items en el archivo fs/btrfs/delayed-inode.c. • https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19813 https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html https://security.netapp.com/advisory/ntap-20200103-0001 https://usn.ubuntu.com/4414-1 • CWE-416: Use After Free •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19814
https://notcve.org/view.php?id=CVE-2019-19814
In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bounded by the number of dirty types (8) but the array index can exceed this. En el kernel de Linux versión 5.0.21, montar una imagen del sistema de archivos f2fs especialmente diseñada puede causar un acceso de escritura fuera de límites en la función __remove_dirty_segment porque una matriz está limitada por parte del número de tipos sucios (8) pero el índice de la matriz puede exceder esto. • https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19814 https://security.netapp.com/advisory/ntap-20200103-0001 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19241 – Linux 5.3 - Privilege Escalation via io_uring Offload of sendmsg() onto Kernel Thread with Kernel Creds
https://notcve.org/view.php?id=CVE-2019-19241
In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORING_OP_SENDMSG operations, although requested in the context of an unprivileged user, are sometimes performed by a kernel worker thread without considering that context. En el kernel de Linux versiones anteriores a la versión 5.4.2, la característica io_uring genera peticiones que inadvertidamente tienen UID 0 y capacidades completas, también se conoce como CID-181e448d8709. • https://www.exploit-db.com/exploits/47779 https://bugs.chromium.org/p/project-zero/issues/detail?id=1975 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=181e448d8709e517c9c7b523fcd209f24eb38ca7 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d69e07793f891524c6bbf1e75b9ae69db4450953 https://security.netapp.com/advisory/ntap-20200103-0001 https://usn.ubuntu.com/4284-1 •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 1CVE-2019-19807 – kernel: use-after-free in sound/core/timer.c
https://notcve.org/view.php?id=CVE-2019-19807
In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring. En el kernel de Linux versiones anteriores a la versión 5.3.11, el archivo sound/core/timer.c tiene un uso de la memoria previamente liberada causado por una refactorización de código errónea, también se conoce como CID-e7af6307a8a5. Esto está relacionado con las funciones snd_timer_open y snd_timer_close_locked. • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e7af6307a8a54f0b873960b32b6a644f2d0fbd97 https://github.com/torvalds/linux/commit/e7af6307a8a54f0b873960b32b6a644f2d0fbd97 https://security.netapp.com/advisory/ntap-20200103-0001 https://usn.ubuntu.com/4225-1 https://usn.ubuntu.com/4227-1 https://usn.ubuntu.com/4227-2 https://access.redhat.com/security/cve/CVE-2019-19807 https://bugzilla.redhat.com/ • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19767 – kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c and fs/ext4/super.c
https://notcve.org/view.php?id=CVE-2019-19767
The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163. El kernel de Linux versión anterior a 5.4.2 maneja inapropiadamente la función ext4_expand_extra_isize, como es demostrado por un error de uso de la memoria previamente liberada en las funciones __ext4_expand_extra_isize y ext4_xattr_set_entry, relacionadas con los archivos fs/ext4/inode.c y fs/ext4/super.c, también se conoce como CID-4ea99936a163. A use-after-free flaw was found in the Linux kernel’s ext4 file system functionality when the user mount ext4 partition, with the usage of an additional debug parameter is defining an extra inode size. If this parameter has a non zero value, this flaw allows a local user to crash the system when inode expansion happens. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html https://bugzilla.kernel.org/show_bug.cgi?id=205609 https://bugzilla.kernel.org/show_bug.cgi?id=205707 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a https://github.com/torvalds/linux/commit/4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html h • CWE-416: Use After Free •