CVE-2019-19767: Use After Free
A use-after-free flaw was found in the Linux kernel’s ext4 file system functionality when the user mount ext4 partition, with the usage of an additional debug parameter is defining an extra inode size. If this parameter has a non zero value, this flaw allows a local user to crash the system when inode expansion happens.
Other sources
The Linux kernel before 5.4.2 mishandles ext4expandextraisize, as demonstrated by use-after-free errors in ext4expandextraisize and ext4xattrsetentry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163.
The Linux kernel before 5.4.2 mishandles ext4expandextraisize, as demonstrated by use-after-free errors in ext4expandextraisize and ext4xattrsetentry, related to fs/ext4/inode.c and fs/ext4/super.c.
References: https://bugzilla.kernel.org/showbug.cgi?id=205609 https://bugzilla.kernel.org/showbug.cgi?id=205707
Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.26.1.el7a - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.rt7.54.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.4.2Patch CID-4ea99936a163 - Configuration
When mounting ext4, do not use the debug_want_extra_isize parameter (or ensure it is not set to a non-zero value), since non-zero values trigger inode expansion that can lead to a use-after-free crash.
Linux kernel ext4 mount debug_want_extra_isize = 0 (do not set to non-zero)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-19767?
CVE-2019-19767 is classified as a high severity vulnerability due to its potential to cause system crashes.
How do I fix CVE-2019-19767?
To fix CVE-2019-19767, update your Linux kernel to the latest versions provided by your distribution, specifically to versions 0:3.10.0-1160.rt56.1131.el7, 0:4.14.0-115.26.1.el7a, or any later secure releases.
Who is affected by CVE-2019-19767?
CVE-2019-19767 affects local users of Linux systems using specific versions of the kernel with the ext4 file system.
What does CVE-2019-19767 exploit?
CVE-2019-19767 exploits a use-after-free vulnerability in the ext4 file system when an additional debug parameter is enabled.
Is there a risk of remote exploitation with CVE-2019-19767?
CVE-2019-19767 does not pose a risk of remote exploitation as it requires local access to the system.