CVE-2019-15538: High severity Linux Linux kernel vulnerability
A flaw was found in the XFS file system in the Linux kernel. An acquired ILOCK was not freed/unlock when the call to xfsqmvopchownreserve fails and the lock is still held and can lead to denial to access for that device. This is primarily a local denial of service but could result in a remote denial of service if the XFS file system is exported as an NFS file system.
Other sources
An issue was discovered in xfssetattrnonsize in fs/xfs/xfsiops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfssetattrnonsize is failing to unlock the ILOCK after the xfsqmvopchownreserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
— Ubuntu
An issue was discovered in xfssetattrnonsize in fs/xfs/xfsiops.c in the Linux kernel. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfssetattrnonsize is failing to unlock the ILOCK after the xfsqmvopchownreserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
Reference: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1fb254aa983bf190cfd685d40c64a480a9bafaee https://github.com/torvalds/linux/commit/1fb254aa983bf190cfd685d40c64a480a9bafaee https://lore.kernel.org/linux-xfs/20190823192433.GA8736@eldamar.local https://lore.kernel.org/linux-xfs/20190823035528.GH1037422@magnolia/
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.21.2.el7a - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1 - Upgrade
Upgrade
Linux kernel XFSto a version that resolves this vulnerability.Patch 1fb254aa983bf190cfd685d40c64a480a9bafaee
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15538?
CVE-2019-15538 has been classified as a medium severity vulnerability due to its potential for denial of service.
How do I fix CVE-2019-15538?
To remediate CVE-2019-15538, update to kernel version 5.10.223-1 or higher, or apply the relevant security patches provided by your Linux distribution.
Which Linux kernels are affected by CVE-2019-15538?
CVE-2019-15538 affects Linux Kernel versions between 4.7 and 5.3.
What causes CVE-2019-15538?
CVE-2019-15538 is caused by a flaw in the XFS file system that prevents proper release of ILOCK during specific operations.
Is CVE-2019-15538 exploitable remotely?
CVE-2019-15538 is primarily regarded as a local denial of service vulnerability, but could potentially lead to remote denial of service under specific conditions.