PT-2019-4754 · Linux+1 · Linux Kernel+1

Jann Horn

·

Published

2019-11-12

·

Updated

2020-05-01

·

CVE-2019-15792

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.0 and 5.3
Description The issue is related to a non-upstream patch in the Linux kernel, specifically in the shiftfs component. It involves a type conversion error, where the shiftfs btrfs ioctl fd replace() function calls fdget(oldfd) and then passes the resulting file* into shiftfs real fdget(), which casts file->private data to a struct shiftfs file info *. Since private data is not required to be a pointer, an attacker can exploit this to cause a denial of service or possibly execute arbitrary code.
Recommendations For Linux kernel versions 5.0 and 5.3, consider disabling the shiftfs btrfs ioctl fd replace() function as a temporary workaround until a patch is available. Restrict access to the shiftfs real fdget() function to minimize the risk of exploitation. Avoid using the private data variable in the affected kernel series until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Type Confusion

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2020-01326
CVE-2019-15792
USN-4183-1
USN-4184-1

Affected Products

Linux Kernel
Ubuntu