CVE-2019-19807: Use After Free
A memory flaw was found in the ALSA subsystem of the Linux kernel. The struct sndtimerinstance function fails the timer->maxinstances check leading to an invalid address. This could lead to a use-after-free vulnerability.
Other sources
In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to sndtimeropen and sndtimercloselocked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.
In the Linux kernel, sound/core/timer.c has a use-after-free caused by erroneous code refactoring. This is related to sndtimeropen and sndtimercloselocked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.
References:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11
Upstream Patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e7af6307a8a54f0b873960b32b6a644f2d0fbd97https://github.com/torvalds/linux/commit/e7af6307a8a54f0b873960b32b6a644f2d0fbd97
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.13.2.rt13.65.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.13.2.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.24.2.el8_1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.11-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 5.3.11Patch CID-e7af6307a8a5 - Compensating control
If you cannot immediately upgrade, mitigate by restricting access/usage of the ALSA sound subsystem in environments where it is not needed (e.g., avoid loading/using ALSA modules on affected systems), since Red Hat could not identify a practical mitigation.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What vulnerability is identified by CVE-2019-19807?
CVE-2019-19807 is a use-after-free vulnerability in the ALSA subsystem of the Linux kernel due to a memory flaw in the struct snd_timer_instance function.
What is the severity of CVE-2019-19807?
CVE-2019-19807 has been classified as a Medium severity vulnerability.
How do I fix CVE-2019-19807?
To fix CVE-2019-19807, update the Linux kernel to version 5.3.11 or later, or apply the relevant patches provided by your Linux distribution.
Which Linux distributions are affected by CVE-2019-19807?
CVE-2019-19807 affects various Linux distributions including Red Hat, Ubuntu, and Debian prior to patched versions.
What are the conditions that lead to CVE-2019-19807 being exploited?
CVE-2019-19807 can be exploited when the ALSA subsystem is used in a specific way that bypasses the max_instances check, leading to memory corruption.