PT-2019-2520 · Palo Alto Networks+4 · Pan-Os+4

Publicado

2018-04-06

·

Atualizado

2024-06-15

·

CVE-2019-8912

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.20.11 PAN-OS versions prior to 7.1.24 PAN-OS versions prior to 8.0.18 PAN-OS versions prior to 8.1.9 PAN-OS versions prior to 9.0.3
Description The issue is related to a use-after-free in the Linux kernel's sockfs setattr, caused by the af alg release function neglecting to set a NULL value for a certain structure member. This can be exploited to allow an unprivileged local user to escalate their privileges on the system.
Recommendations For Linux kernel versions prior to 4.20.11, update to version 4.20.11 or later to resolve the issue. For PAN-OS versions prior to 7.1.24, update to version 7.1.24 or later. For PAN-OS versions prior to 8.0.18, update to version 8.0.18 or later. For PAN-OS versions prior to 8.1.9, update to version 8.1.9 or later. For PAN-OS versions prior to 9.0.3, update to version 9.0.3 or later.

Correção

Use After Free

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

ALT-PU-2018-1557
ALT-PU-2019-1299
ALT-PU-2019-1307
ALT-PU-2019-1313
BDU:2019-02363
CVE-2019-8912
OPENSUSE-SU-2019:1193-1
OPENSUSE-SU-2019_1193-1
OPENSUSE-SU-2024:10728-1
OPENSUSE-SU-2024:13704-1
RHSA-2020:0174
SUSE-SU-2019:0726-1
SUSE-SU-2019:0740-1
SUSE-SU-2019:0745-1
SUSE-SU-2019:0765-1
SUSE-SU-2019:0767-1
SUSE-SU-2019:0784-1
SUSE-SU-2019:0785-1
SUSE-SU-2019:0845-1
USN-3930-1
USN-3930-2
USN-3931-1
USN-3931-2

Produtos afetados

Alt Linux
Linux Kernel
Pan-Os
Suse
Ubuntu