SB2019120522 - Multiple vulnerabilities in Linux kernel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019120522

SB2019120522 - Multiple vulnerabilities in Linux kernel

Published: December 5, 2019 Updated: July 17, 2020

Security Bulletin ID SB2019120522
Severity
Low
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Improper Privilege Management (CVE-ID: CVE-2019-19241)

The vulnerability allows a local authenticated user to execute arbitrary code.

In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORING_OP_SENDMSG operations, although requested in the context of an unprivileged user, are sometimes performed by a kernel worker thread without considering that context.


2) Use-after-free (CVE-ID: CVE-2019-19767)

The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.

The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163.


3) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2019-19602)

The vulnerability allows a local authenticated user to #BASIC_IMPACT#.

fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstrated by mishandling of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc.


Remediation

Install update from vendor's website.

References