PT-2019-1635 · Linux+2 · Linux Kernel+2

Jakub Jirasek · Published 2019-02-01 · Updated 2025-09-29 · CVE-2019-8956

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 4.20.8 Linux Kernel versions prior to 4.19.21

Description A use-after-free error in the sctp sendmsg() function when handling the SCTP SENDALL flag can be exploited to corrupt memory, potentially allowing an attacker to cause a denial of service or elevate their privileges. The issue is related to the implementation of the SCTP protocol in the Linux Kernel.

Recommendations For Linux Kernel versions prior to 4.20.8, update to version 4.20.8 or later to resolve the issue. For Linux Kernel versions prior to 4.19.21, update to version 4.19.21 or later to resolve the issue. As a temporary workaround, consider disabling the sctp sendmsg() function until a patch is available.

Exploit

Fix

Use After Free

Memory Corruption

Weakness Enumeration

CWE-416

CWE-787

Related Identifiers

ALSA-2025_16880

ALT-PU-2019-1231

ALT-PU-2019-1286

BDU:2019-01183

CVE-2019-8956

USN-3930-1

USN-3930-2

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 40

• 🔥 https://github.com/butterflyhack/CVE-2019-8956 · Exploit
• 🔥 https://secuniaresearch.flexerasoftware.com/secunia_research/2019-5 · Exploit
• https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=ba59fb0273076637f0add4311faa990a5eec27c0 · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.21 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-8956 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-7222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8956 · Security Note
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8956 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9003 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3459 · Vendor Advisory
• https://usn.ubuntu.com/3930-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19824 · Vendor Advisory
• https://usn.ubuntu.com/3930-2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-8956 · Security Note