CVSS: 6.7EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19769
https://notcve.org/view.php?id=CVE-2019-19769
In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h). En el kernel de Linux versión 5.3.10, se presenta un uso de la memoria previamente liberada en la función perf_trace_lock_acquire (relacionada con el archivo include/trace/events/lock.h). • https://bugzilla.kernel.org/show_bug.cgi?id=205705 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF4PQZBEPNXDSK5DOBMW54OCLP25FTCD https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJSIZWKW7RDHKU3CHC5BFAQI43NVHLUQ https://security.netapp.com/advisory/ntap-20200103-0001 https://usn.ubuntu.com/4368-1 https://usn.ubuntu.com/4369-1 • CWE-416: Use After Free •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19770 – kernel: use-after-free in debugfs_remove in fs/debugfs/inode.c
https://notcve.org/view.php?id=CVE-2019-19770
In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of debugfs within blktrace ** EN DISPUTA ** En el kernel de Linux versión 4.19.83, presenta un uso de la memoria previamente liberada en la función debugfs_remove en el archivo fs/debugfs/inode.c (que se usa para eliminar un archivo o directorio en debugfs que se creó previamente con una llamada a otra función debugfs como debugfs_create_file). NOTA: Los desarrolladores del kernel de Linux disputan este problema como no un problema con debugfs, sino que es un problema con el mal uso de debugfs dentro de blktrace. A use-after-free flaw was found in the debugfs_remove function in the Linux kernel. The flaw could allow a local attacker with special user (or root) privilege to crash the system at the time of file or directory removal. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html https://bugzilla.kernel.org/show_bug.cgi?id=205713 https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html https://lore.kernel.org/linux-block/20200402000002.7442-1-mcgrof%40kernel.org https://security.netapp.com/advisory/ntap-20200103-0001 https://access.redhat.com/security/cve/CVE-2019-19770 https://bugzilla.redhat.com/show_bug.cgi?id=1786179 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2019-19768 – kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c
https://notcve.org/view.php?id=CVE-2019-19768
In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer). En el kernel de Linux versión 5.4.0-rc2, se presenta un uso de la memoria previamente liberada en la función __blk_add_trace en el archivo kernel/trace/blktrace.c (que se usa para completar una estructura blk_io_trace y colocarla en un per-cpu sub-buffer). A use-after-free vulnerability was found in the Linux kernel’s implementation of blktrace in the __blk_add_trace function. A local attacker with permissions to run block trace instructions against a device can create a situation where the core block_trace object is used after it is freed. The attacker can pre-groom memory to race this use-after-free to create a condition where the memory is corrupted and cause privilege escalation. The ability to create this condition requires elevated privileges, and it has been decided that this change in Red Hat Enterprise Linux 5 and 6 would risk introducing possible regressions and will not be backported. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00039.html https://bugzilla.kernel.org/show_bug.cgi?id=205711 https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html https://security.netapp.com/advisory/ntap-20200103-0001 https://usn.ubuntu.com/4342-1 https://usn.ubuntu.com/4344-1 https://usn.ubuntu.com/4345-1 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19449
https://notcve.org/view.php?id=CVE-2019-19449
In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated). En el kernel de Linux versión 5.0.21, montando una imagen de sistema de archivos f2fs diseñada puede conllevar a un acceso de lectura fuera de límites en la función f2fs_build_segment_manager en el archivo fs/f2fs/segment.c, relacionado con la función init_min_max_mtime en el archivo fs/f2fs/segment.c (porque el segundo argumento para la función get_seg_entry no es validado). • https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19449 https://security.netapp.com/advisory/ntap-20200103-0001 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 35EXPL: 1CVE-2019-19448
https://notcve.org/view.php?id=CVE-2019-19448
In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure. En el kernel de Linux versiones 5.0.21 y 5.3.11, montando una imagen de sistema de archivos btrfs diseñada, al realizar algunas operaciones y luego haciendo una llamada de sistema syncfs puede conllevar a un uso de la memoria previamente liberada en la función try_merge_free_space en el archivo fs/btrfs/free-space-cache.c porque el puntero en una estructura de datos izquierda puede ser el mismo que el puntero en una estructura de datos derecha. • https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19448 https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html https://security.netapp.com/advisory/ntap-20200103-0001 https://usn.ubuntu.com/4578-1 • CWE-416: Use After Free •