PT-2019-17410 · Pax Team+1 · Pax+1
Published
2019-10-31
·
Updated
2022-06-07
·
CVE-2019-5023
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
PaX versions pax-linux-4.9.8-test1 through 4.9.24-test7
grsecurity official versions grsecurity-3.1-4.9.8-201702060653 through grsecurity-3.1-4.9.24-201704252333
grsecurity unofficial versions v4.9.25-unofficialgrsec through v4.9.74-unofficialgrsec
Description
A memory leakage issue exists in the grsecurity PaX patch due to the
read kmem function not freeing a temp buffer when an invalid address is supplied. This can lead to a system crash. An attacker can exploit this by inducing a read to /dev/kmem using an invalid address.Recommendations
For PaX versions pax-linux-4.9.8-test1 through 4.9.24-test7, consider disabling the
read kmem function to prevent exploitation until a patch is available.
For grsecurity official versions grsecurity-3.1-4.9.8-201702060653 through grsecurity-3.1-4.9.24-201704252333, restrict access to /dev/kmem to minimize the risk of exploitation.
For grsecurity unofficial versions v4.9.25-unofficialgrsec through v4.9.74-unofficialgrsec, avoid using invalid addresses with the read kmem function until the issue is resolved.Exploit
Fix
Memory Leak
Missing Release of Resource after Effective Lifetime
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pax
Grsecurity