CVE-2019-11833: Infoleak
A flaw was found in the Linux kernel's implementation of ext4 extent management. The kernel doesn't correctly initialize memory regions in the extent tree block which may be exported to a local user to obtain sensitive information by reading empty/uninitialized data from the filesystem.
Other sources
A flaw was found in the Linux kernels implementation of ext4 extent management which did not correctly initialize memory regions in the extent tree block which may be exported to a local user to obtain sensitive information by reading empty/uninitialized data from the filesystem.
This is considered an information leak, but the information leveraged could be used in to future another attack.
Upstream patch:
https://github.com/torvalds/linux/commit/592acbf16821288ecdc4192c47e3774a4c48bb64
— Red Hat
fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.rt56.1022.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.rt24.93.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
Linux kernel (ext4)to a version that resolves this vulnerability.Fixed in 5.1.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-11833?
CVE-2019-11833 is classified as a medium severity vulnerability affecting the Linux kernel's ext4 filesystem.
How do I fix CVE-2019-11833?
To fix CVE-2019-11833, update your system to the patched versions of the Linux kernel provided by your distribution.
Which systems are affected by CVE-2019-11833?
CVE-2019-11833 affects various distributions of the Linux kernel including specific versions for Red Hat, Debian, and Ubuntu.
What type of vulnerability is CVE-2019-11833?
CVE-2019-11833 is a memory initialization flaw that may allow local users to read uninitialized data from the filesystem.
Is CVE-2019-11833 exploitable remotely?
CVE-2019-11833 is not exploitable remotely; it requires local access to the affected system.