CVE-2019-19319
Summary
| CVE | CVE-2019-19319 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-11-27 23:15:00 UTC |
| Updated | 2021-02-09 19:15:00 UTC |
| Description | In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call, aka CID-345c0dbf3a30. |
Risk And Classification
Problem Types: CWE-787 | CWE-416
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | 5.0.21 | All | All | All |
| Operating System | Linux | Linux Kernel | 5.0.21 | All | All | All |
| Operating System | Opensuse | Leap | 15.1 | All | All | All |
| Operating System | Opensuse | Leap | 15.1 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| kernel/git/torvalds/linux.git - Linux kernel source tree | CONFIRM | git.kernel.org | |
| USN-4391-1: Linux kernel vulnerabilities | Ubuntu security notices | UBUNTU | usn.ubuntu.com | |
| December 2019 Linux Kernel Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | Third Party Advisory |
| [security-announce] openSUSE-SU-2020:0336-1: important: Security update | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| CVE/CVE-2019-19319 at master · bobfuzzer/CVE · GitHub | MISC | github.com | Exploit, Third Party Advisory |
| [SECURITY] [DLA 2241-2] linux security update | MLIST | lists.debian.org | |
| [SECURITY] [DLA 2242-1] linux-4.9 security update | MLIST | lists.debian.org | |
| [SECURITY] [DLA 2241-1] linux security update | MLIST | lists.debian.org | |
| Debian -- Security Information -- DSA-4698-1 linux | DEBIAN | www.debian.org | |
| Bug 1158021 – VUL-0: CVE-2019-19319: kernel-source: setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access | MISC | bugzilla.suse.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159684 Oracle Enterprise Linux Security Update for kernel (ELSA-2020-4431)
- 352300 Amazon Linux Security Advisory for kernel: ALAC2012-2020-020
- 352348 Amazon Linux Security Advisory for kernel-livepatch: ALAS2LIVEPATCH-2020-020
- 352349 Amazon Linux Security Advisory for kernel-livepatch: ALAS2LIVEPATCH-2020-019
- 352350 Amazon Linux Security Advisory for kernel-livepatch: ALAS2LIVEPATCH-2020-018
- 352351 Amazon Linux Security Advisory for kernel-livepatch: ALAS2LIVEPATCH-2020-017
- 670269 EulerOS Security Update for kernel (EulerOS-SA-2021-1808)
- 940256 AlmaLinux Security Update for kernel (ALSA-2020:4431)