PT-2019-2520 · Palo Alto Networks+4 · Pan-Os+4

Published 2018-04-06 · Updated 2024-06-15 · CVE-2019-8912

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.20.11 PAN-OS versions prior to 7.1.24 PAN-OS versions prior to 8.0.18 PAN-OS versions prior to 8.1.9 PAN-OS versions prior to 9.0.3

Description The issue is related to a use-after-free in the Linux kernel's sockfs setattr, caused by the af alg release function neglecting to set a NULL value for a certain structure member. This can be exploited to allow an unprivileged local user to escalate their privileges on the system.

Recommendations For Linux kernel versions prior to 4.20.11, update to version 4.20.11 or later to resolve the issue. For PAN-OS versions prior to 7.1.24, update to version 7.1.24 or later. For PAN-OS versions prior to 8.0.18, update to version 8.0.18 or later. For PAN-OS versions prior to 8.1.9, update to version 8.1.9 or later. For PAN-OS versions prior to 9.0.3, update to version 9.0.3 or later.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2018-1557

ALT-PU-2019-1299

ALT-PU-2019-1307

ALT-PU-2019-1313

BDU:2019-02363

CVE-2019-8912

OPENSUSE-SU-2019:1193-1

OPENSUSE-SU-2019_1193-1

OPENSUSE-SU-2024:10728-1

OPENSUSE-SU-2024:13704-1

RHSA-2020:0174

SUSE-SU-2019:0726-1

SUSE-SU-2019:0740-1

SUSE-SU-2019:0745-1

SUSE-SU-2019:0765-1

SUSE-SU-2019:0767-1

SUSE-SU-2019:0784-1

SUSE-SU-2019:0785-1

SUSE-SU-2019:0845-1

USN-3930-1

USN-3930-2

USN-3931-1

USN-3931-2

Affected Products

Alt Linux

Linux Kernel

Pan-Os

Suse

Ubuntu

References · 532

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-8912 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-8912 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-8912 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-8912 · Vendor Advisory
• https://usn.ubuntu.com/3931-2 · Vendor Advisory
• https://usn.ubuntu.com/3930-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0784-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-6974 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0765-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-8912 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:0785-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0726-1 · Vendor Advisory
• http://patchwork.ozlabs.org/patch/1042902 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2019:0745-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9213 · Vendor Advisory