PT-2019-1635 · Linux+2 · Linux Kernel+2

Jakub Jirasek · Publicado 2019-02-01 · Atualizado 2025-09-29 · CVE-2019-8956

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 4.20.8 Linux Kernel versions prior to 4.19.21

Description A use-after-free error in the sctp sendmsg() function when handling the SCTP SENDALL flag can be exploited to corrupt memory, potentially allowing an attacker to cause a denial of service or elevate their privileges. The issue is related to the implementation of the SCTP protocol in the Linux Kernel.

Recommendations For Linux Kernel versions prior to 4.20.8, update to version 4.20.8 or later to resolve the issue. For Linux Kernel versions prior to 4.19.21, update to version 4.19.21 or later to resolve the issue. As a temporary workaround, consider disabling the sctp sendmsg() function until a patch is available.

Exploit

Correção

Use After Free

Memory Corruption

Enumeração de Fraquezas

CWE-416

CWE-787

Identificadores relacionados

ALSA-2025_16880

ALT-PU-2019-1231

ALT-PU-2019-1286

BDU:2019-01183

CVE-2019-8956

USN-3930-1

USN-3930-2

Produtos afetados

Alt Linux

Linux Kernel

Ubuntu

Referências · 40

• 🔥 https://github.com/butterflyhack/CVE-2019-8956 · Exploit
• 🔥 https://secuniaresearch.flexerasoftware.com/secunia_research/2019-5 · Exploit
• https://bugzilla.novell.com/show_bug.cgi?id=1124136 · Nota
• https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=ba59fb0273076637f0add4311faa990a5eec27c0 · Aviso do Fabricante
• https://t.me/proxy_bar/1427 · Publicação no Telegram
• https://access.redhat.com/security/cve/cve-2019-8956 · Nota
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.21 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-8956 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-7222 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8956 · Nota de Segurança
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.8 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-8956 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-9003 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-3459 · Aviso do Fabricante
• https://usn.ubuntu.com/3930-1 · Aviso do Fabricante