CVE-2019-19813: Use After Free
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in mutexlock in kernel/locking/mutex.c. This is related to mutexcanspinonowner in kernel/locking/mutex.c, btrfsqgroupfreemeta in fs/btrfs/qgroup.c, and btrfsinsertdelayeditems in fs/btrfs/delayed-inode.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19813?
CVE-2019-19813 is classified as a high-severity vulnerability due to the potential for a use-after-free condition affecting system stability.
How do I fix CVE-2019-19813?
To resolve CVE-2019-19813, upgrade to Linux kernel versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, or 6.12.10-1.
What systems are affected by CVE-2019-19813?
CVE-2019-19813 affects Linux kernel version 5.0.21 and related systems including Debian and Ubuntu versions.
What type of vulnerability is CVE-2019-19813?
CVE-2019-19813 is a use-after-free vulnerability that occurs in the Linux kernel during synchronization operations.
Is there a workaround for CVE-2019-19813?
There are no official workarounds for CVE-2019-19813; the best mitigation is to apply the recommended kernel updates.