PT-2020-6209 · E2Fsprogs+5 · E2Fsprogs+5

Published 2020-01-07 · Updated 2023-06-28 · CVE-2019-5188

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions E2fsprogs e2fsck versions 1.43.3 through 1.45.4

Description A code execution issue exists in the directory rehashing functionality of E2fsprogs e2fsck. This is caused by an out-of-bounds write on the stack when processing a specially crafted ext4 directory, allowing an attacker to execute code by corrupting a partition. The vulnerability can also lead to unauthorized access to confidential data, disruption of data integrity, and denial of service.

Recommendations For versions 1.43.3 through 1.45.4, update to version 1.45.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the e2fsck utility until the update is applied. Avoid using e2fsck on potentially corrupted partitions until the issue is resolved.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2020-3390

ALT-PU-2023-2092

BDU:2021-03599

CESA-2020_1913

CESA-2020_4011

CVE-2019-5188

DLA-2156-1

DLA-2290-1

MGASA-2020-0039

OPENSUSE-SU-2020:0166-1

OPENSUSE-SU-2020_0166-1

RHSA-2020:1913

RHSA-2020:4011

RHSA-2020_1913

RHSA-2020_4011

SUSE-SU-2020:0265-1

SUSE-SU-2020:0360-1

SUSE-SU-2020_0265-1

SUSE-SU-2020_0360-1

USN-4249-1

Affected Products

Alt Linux

Centos

E2Fsprogs

Red Hat

Suse

Ubuntu

References · 45

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973 · Exploit
• https://osv.dev/vulnerability/MGASA-2020-0039 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5188 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5188 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-5188 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-5188 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03599 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-5188 · Security Note
• https://osv.dev/vulnerability/DLA-2290-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0360-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/681760 · Security Note
• https://advisories.mageia.org/MGASA-2020-0039.html · Security Note
• https://osv.dev/vulnerability/USN-4249-1 · Vendor Advisory