CVE-2019-18178: Use After Free
Published Nov 4, 2019
·Updated
Real Time Engineers FreeRTOS+FAT 160919a has a use after free. The function FFClose() is defined in fffile.c. The file handler pxFile is freed by ffconfigFREE, which (by default) is a macro definition of vPortFree(), but it is reused to flush modified file content from the cache to disk by the function FFFlushCache().
Affected Software
1 affected component
Amazon Freertos\+fat=160919a
Event History
Nov 4, 2019
CVE Published
via MITRE·07:37 PM
Data Sourced
via MITRE·07:37 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-18178?
CVE-2019-18178 has a medium severity due to the potential for use-after-free vulnerabilities.
2
How do I fix CVE-2019-18178?
To fix CVE-2019-18178, ensure that file handlers are properly managed and not freed while in use.
3
What systems are affected by CVE-2019-18178?
CVE-2019-18178 affects Real Time Engineers FreeRTOS+FAT version 160919a.
4
What type of vulnerability is CVE-2019-18178?
CVE-2019-18178 is classified as a use-after-free vulnerability.
5
What function is involved in CVE-2019-18178?
The function involved in CVE-2019-18178 is FF_Close(), which improperly handles file closure.