CVE-2019-15538: High severity Linux Linux kernel vulnerability
A flaw was found in the XFS file system in the Linux kernel. An acquired ILOCK was not freed/unlock when the call to xfsqmvopchownreserve fails and the lock is still held and can lead to denial to access for that device. This is primarily a local denial of service but could result in a remote denial of service if the XFS file system is exported as an NFS file system.
Other sources
An issue was discovered in xfssetattrnonsize in fs/xfs/xfsiops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfssetattrnonsize is failing to unlock the ILOCK after the xfsqmvopchownreserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
An issue was discovered in xfssetattrnonsize in fs/xfs/xfsiops.c in the Linux kernel. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfssetattrnonsize is failing to unlock the ILOCK after the xfsqmvopchownreserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
Reference: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1fb254aa983bf190cfd685d40c64a480a9bafaee https://github.com/torvalds/linux/commit/1fb254aa983bf190cfd685d40c64a480a9bafaee https://lore.kernel.org/linux-xfs/20190823192433.GA8736@eldamar.local https://lore.kernel.org/linux-xfs/20190823035528.GH1037422@magnolia/
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.21.2.el7a - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15538?
CVE-2019-15538 has been classified as a medium severity vulnerability due to its potential for denial of service.
How do I fix CVE-2019-15538?
To remediate CVE-2019-15538, update to kernel version 5.10.223-1 or higher, or apply the relevant security patches provided by your Linux distribution.
Which Linux kernels are affected by CVE-2019-15538?
CVE-2019-15538 affects Linux Kernel versions between 4.7 and 5.3.
What causes CVE-2019-15538?
CVE-2019-15538 is caused by a flaw in the XFS file system that prevents proper release of ILOCK during specific operations.
Is CVE-2019-15538 exploitable remotely?
CVE-2019-15538 is primarily regarded as a local denial of service vulnerability, but could potentially lead to remote denial of service under specific conditions.