PT-2019-2967 · Linux+3 · Linux Kernel+3
Published
2019-04-01
·
Updated
2023-02-12
·
CVE-2019-3896
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions 2.6
Description
A double-free issue exists in the
idr remove all() function in lib/idr.c. This can be exploited by an unprivileged local attacker to potentially escalate privileges or cause a system crash, resulting in a denial of service (DoS).Recommendations
For Linux kernel version 2.6, consider applying a patch to fix the
idr remove all() function issue as a permanent solution. As a temporary workaround, restrict access to the idr remove all() function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Use After Free
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Centos
Linux Kernel
Red Hat
Suse