kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c and fs/ext4/super.c
Published Dec 12, 2019
5.5
MEDIUMCVSS 3.1
EPSS 2.08%
Description
The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163.
Affected products
No data.
- < 5.4.2
No data.
Red Hat Enterprise Linux 7
kernel-0:3.10.0-1160.el7
Fixed · RHSA-2020:4060
Red Hat Enterprise Linux 7
kernel-alt-0:4.14.0-115.26.1.el7a
Fixed · RHSA-2020:2854
Red Hat Enterprise Linux 7
kernel-rt-0:3.10.0-1160.rt56.1131.el7
Fixed · RHSA-2020:4062
Red Hat Enterprise Linux 8
kernel-0:4.18.0-240.el8
Fixed · RHSA-2020:4431
Red Hat Enterprise Linux 8
kernel-rt-0:4.18.0-240.rt7.54.el8
Fixed · RHSA-2020:4609
Red Hat Enterprise Linux 5
kernel
Not affected
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise MRG 2
kernel-rt
Out of support scope
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | kernel-0:3.10.0-1160.el7 | Fixed | RHSA-2020:4060 |
| Red Hat Enterprise Linux 7 | kernel-alt-0:4.14.0-115.26.1.el7a | Fixed | RHSA-2020:2854 |
| Red Hat Enterprise Linux 7 | kernel-rt-0:3.10.0-1160.rt56.1131.el7 | Fixed | RHSA-2020:4062 |
| Red Hat Enterprise Linux 8 | kernel-0:4.18.0-240.el8 | Fixed | RHSA-2020:4431 |
| Red Hat Enterprise Linux 8 | kernel-rt-0:4.18.0-240.rt7.54.el8 | Fixed | RHSA-2020:4609 |
| Red Hat Enterprise Linux 5 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise MRG 2 | kernel-rt | Out of support scope | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
The mitigation is not to use debug_want_extra_isize parameter when mounting ext4 FS.
References (17)
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html vendor-advisoryx_refsource_SUSE
- https://access.redhat.com/security/cve/CVE-2019-19767 Vendor Advisory
- https://bugzilla.kernel.org/show_bug.cgi?id=205609 x_refsource_MISCExploitIssue TrackingVendor Advisory
- https://bugzilla.kernel.org/show_bug.cgi?id=205707 x_refsource_MISCIssue TrackingVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1786160 Issue Tracking
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2 x_refsource_MISCRelease NotesVendor Advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a x_refsource_MISCPatchVendor Advisory
- https://github.com/torvalds/linux/commit/4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a x_refsource_MISCPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html mailing-listx_refsource_MLIST
- https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html mailing-listx_refsource_MLIST
- https://nvd.nist.gov/vuln/detail/CVE-2019-19767
- https://security.netapp.com/advisory/ntap-20200103-0001/ x_refsource_CONFIRM
- https://usn.ubuntu.com/4258-1/ vendor-advisoryx_refsource_UBUNTU
- https://usn.ubuntu.com/4284-1/ vendor-advisoryx_refsource_UBUNTU
- https://usn.ubuntu.com/4287-1/ vendor-advisoryx_refsource_UBUNTU
- https://usn.ubuntu.com/4287-2/ vendor-advisoryx_refsource_UBUNTU
- https://www.cve.org/CVERecord?id=CVE-2019-19767
Change history (0)
No recorded changes yet.