CVE-2019-15239: Use After Free
A flaw was found in the way the Linux kernel's networking subsystem handled the write queue between TCP disconnection and re-connections. A local attacker could use this flaw to trigger multiple use-after-free conditions potentially escalating their privileges on the system.
Other sources
A vulnerability was found in In the Linux kernel, a certain net/ipv4/tcpoutput.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7f582b248d0a86bae5788c548d7bb5bca6f7691a https://lore.kernel.org/stable/41a61a2f87691d2bc839f26cdfe6f5ff2f51e472.camel@decadent.org.uk/
— Red Hat
In the Linux kernel, a certain net/ipv4/tcpoutput.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. NOTE: this affects (for example) Linux distributions that use 4.9.x longterm kernels before 4.9.190 or 4.14.x longterm kernels before 4.14.139.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.7.1.rt56.1030.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.7.1.el7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 4.19.249-2Fixed in 4.19.289-2Fixed in 5.10.197-1Fixed in 5.10.191-1Fixed in 6.1.66-1Fixed in 6.1.52-1Fixed in 6.5.13-1Fixed in 6.6.8-1 - Upgrade
Upgrade
Linux kernel (net/ipv4/tcp_output.c)to a version that resolves this vulnerability.Fixed in 4.9.190 - Upgrade
Upgrade
Linux kernel (net/ipv4/tcp_output.c)to a version that resolves this vulnerability.Fixed in 4.14.139 - Upgrade
Upgrade
Linux kernel (net/ipv4/tcp_output.c)to a version that resolves this vulnerability.Fixed in 4.16.12
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-15239?
CVE-2019-15239 is a vulnerability found in the Linux kernel's networking subsystem that can be exploited to cause a denial of service or potentially execute arbitrary code.
How severe is CVE-2019-15239?
CVE-2019-15239 has a severity rating of 7.4 out of 10, indicating a high severity.
Which versions of Linux kernel are affected by CVE-2019-15239?
CVE-2019-15239 affects Linux kernel versions 4.16.12, 3.10.0-1062.7.1.rt56.1030.el7, and 3.10.0-1062.7.1.el7.
How can CVE-2019-15239 be exploited?
CVE-2019-15239 can be exploited by an attacker to manipulate the write queue and potentially execute arbitrary code or cause a denial of service.
Is there a fix for CVE-2019-15239?
Yes, a fix for CVE-2019-15239 is available. It is recommended to update the affected Linux kernel versions to the patched versions.