PT-2019-1111 · Linux+3 · Linux Kernel+3
Tristan Madani
·
Publicado
2019-11-13
·
Atualizado
2021-07-11
·
CVE-2019-19769
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel version 5.3.10
Description:
The issue is related to a use-after-free in the
perf trace lock acquire function, which can lead to a denial of service. Additionally, there is a possible out of bounds write due to a use after free in the locks wake up blocks function of locks.c, which could result in local escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation.Recommendations:
For Linux kernel version 5.3.10, consider disabling the
perf trace lock acquire function as a temporary workaround until a patch is available.
Restrict access to the locks.c module to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Linux Kernel
Suse
Ubuntu