huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2019-1543: openssl: ChaCha20-Poly1305 with long nonces
Component: openssl
Severity: Low
CWE: CWE-323 (Reusing a Nonce, Key Pair in Encryption)
CVSS v3: 2.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2019-03-06T00:00:00+00:00

ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).


Affected upstream versions: Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b), Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j)
Fixed upstream versions: OpenSSL_1_1_1c
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: f426625b6ae9a7831010750490a5f0ad689c5ba3
CVE-2019-1547: openssl: side-channel weak encryption vulnerability
Component: openssl
Severity: Moderate
CWE: CWE-602 (Client-Side Enforcement of Server-Side Security)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2019-09-10T00:00:00+00:00

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Statement: As per upstream: In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. Also libssl is not vulnerable because explicit parameters are never used.

Affected upstream versions: Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c), Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k), Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)
Fixed upstream versions: OpenSSL_1_1_1d
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 30c22fa8b1d840036b8e203585738df62a03cec8
CVE-2019-1549: openssl: information disclosure in fork()
Component: openssl
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2019-09-10T00:00:00+00:00

OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).


Affected upstream versions: Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c)
Fixed upstream versions: OpenSSL_1_1_1d
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be
CVE-2019-15505: kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H)
Public date: 2019-08-23T00:00:00+00:00

An out-of-bounds read flaw was found in the DVB USB subsystem of the Linux kernel. There was no boundary check applied to the array in struct technisat_usb2_state state->buf until the 0xff byte is encountered. If the byte is not encountered within the limit, an exposure of kernel data structure occurs. Data confidentiality and system availability are the highest threats with this vulnerability.


Affected upstream versions: n/a
Upstream repository: https://git.linuxtv.org/media_tree.git
Upstream fix commit: 0c4df39e504bf925ab666132ac3c98d6cbbe380b
CVE-2019-1551: openssl: Integer overflow in RSAZ modular exponentiation on x86_64
Component: openssl
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2019-12-06T00:00:00+00:00

An integer overflow was found in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli.  As per upstream:

* No EC algorithms are affected. 

* Attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. 

* Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway.

* Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME

Statement: Accelerated modular exponentiation for Intel processors (RSAZ) was introduced in openssl-1.0.2, therefore older versions of OpenSSL are not affected by this flaw.

Affected upstream versions: Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d), Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t)
Fixed upstream versions: OpenSSL_1_1_1e
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 419102400a2811582a7a3d4a4e317d72e5ce0a8f
CVE-2019-15538: kernel: denial of service in in xfs_setattr_nonsize in fs/xfs/xfs_iops.c
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-08-25T00:00:00+00:00

A flaw was found in the XFS file system in the Linux kernel. An acquired ILOCK was not freed/unlock when the call to xfs_qm_vop_chown_reserve fails and the lock is still held and can lead to denial to access for that device. This is primarily a local denial of service but could result in a remote denial of service if the XFS file system is exported as an NFS file system.


Affected upstream versions: n/a
Fixed upstream versions: v5.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 1fb254aa983bf190cfd685d40c64a480a9bafaee
CVE-2019-1559: openssl: 0-byte record padding oracle
Component: openssl
Severity: Moderate
CWE: CWE-325 (Missing Cryptographic Step)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2019-02-26T00:00:00+00:00

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

Statement: 1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.
2. There are multiple other requirements for the attack to succeed: 
    - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)
    - the attacker has to be a MITM
    - the attacker has to be able to control the client side to send requests to the buggy server on demand

Affected upstream versions: Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)
Fixed upstream versions: OpenSSL_1_0_2r
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e
CVE-2019-1563: openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey
Component: openssl
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2019-09-10T00:00:00+00:00

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).


Affected upstream versions: Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c), Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k), Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)
Fixed upstream versions: OpenSSL_1_1_1d
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 08229ad838c50f644d7e928e2eef147b4308ad64
CVE-2019-15666: kernel: out-of-bounds array access in __xfrm_policy_unlink
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-08-27T00:00:00+00:00

A flaw was found in the Linux kernel. When xfrm policy removal occurs a system crash could occur. These policy changes generally occur through the ip command or a netlink socket.

Statement: A local privileged user (with CAP_NET_ADMIN or root) is required to exploit this condition. With this limitation, this issue is rated as Moderate.

Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b805d78d300bcf2c83d6df7da0c818b0fee41427
CVE-2019-15691: tigervnc: Stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
Component: tigervnc
Severity: Moderate
CWE: CWE-672 (Operation on a Resource after Expiration or Release)
CVSS v3: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-12-20T00:00:00+00:00

TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


Affected upstream versions: 1.10.0
Upstream repository: https://github.com/CendioOssman/tigervnc
Upstream fix commit: d61a767d6842b530ffb532ddd5a3d233119aad40
CVE-2019-15692: tigervnc: Heap buffer overflow triggered from CopyRectDecoder due to incorrect value checks
Component: tigervnc
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-09-10T00:00:00+00:00

TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


Affected upstream versions: 1.10.0
Upstream repository: https://github.com/CendioOssman/tigervnc
Upstream fix commit: 996356b6c65ca165ee1ea46a571c32a1dc3c3821
CVE-2019-15693: tigervnc: Heap buffer overflow in TightDecoder::FilterGradient
Component: tigervnc
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-12-20T00:00:00+00:00

TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


Affected upstream versions: 1.10.0
Upstream repository: https://github.com/CendioOssman/tigervnc
Upstream fix commit: b4ada8d0c6dac98c8b91fc64d112569a8ae5fb95
CVE-2019-15694: tigervnc: Heap buffer overflow in DecodeManager::decodeRect
Component: tigervnc
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-12-20T00:00:00+00:00

TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


Affected upstream versions: 1.10.0
Upstream repository: https://github.com/CendioOssman/tigervnc
Upstream fix commit: 0943c006c7d900dfc0281639e992791d6c567438
CVE-2019-15695: tigervnc: Stack buffer overflow in CMsgReader::readSetCursor
Component: tigervnc
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-12-20T00:00:00+00:00

TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


Affected upstream versions: 1.10.0
Upstream repository: https://github.com/CendioOssman/tigervnc
Upstream fix commit: 05e28490873a861379c943bf616614b78b558b89
CVE-2019-15794: kernel: Overlayfs in the Linux kernel and shiftfs  not restoring original value on error leading to a refcount underflow
Component: kernel
Severity: Moderate
CWE: CWE-672 (Operation on a Resource after Expiration or Release)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-11-12T00:00:00+00:00

A flaw was found in the Linux kernel. In Overlayfs, vma->vm_file was replaced in the mmap handlers and, on errors, the original value is not restored. A local attacker with special user privilege (or root) can cause a kernel internal information leak. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: 5.3 kernel < 5.3.0-24.26, 5.0 kernel < 5.0.0-37.40
Fixed upstream versions: 5.0.0-37.40, 5.3.0-24.26
Upstream repository: https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan
Upstream fix commit: 270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
CVE-2019-15807: kernel: Memory leak in drivers/scsi/libsas/sas_expander.c
Component: kernel
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-08-29T00:00:00+00:00

A memory leak flaw was found in the Linux kernel. An error in the resource cleanup of the sas_ex_discover_expander function can allow an attacker to induce error conditions that could crash the system. The highest threat from this vulnerability is to system availability.

Statement: This issue is rated as having Low impact because of the preconditions needed to trigger the error/resource cleanup code path (system-wide out-of-memory condition, high privileges or physical access).

Affected upstream versions: n/a
Fixed upstream versions: v5.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3b0541791453fbe7f42867e310e0c9eb6295364d
CVE-2019-15890: QEMU: Slirp: use-after-free during packet reassembly
Component: QEMU
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.6 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H)
Public date: 2019-08-25T00:00:00+00:00

A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ip_reass() routine while reassembling incoming packets, if the first fragment is bigger than the m->m_dat[] buffer. A user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service.

Statement: Red Hat OpenStack Platform:                                                                                                                 
* This flaw impacts KVM user-mode or SLIRP networking, which is not used in Red Hat OpenStack Platform. Although updating is recommended for affected versions (see below), Red Hat OpenStack Platform environments are not vulnerable.

Affected upstream versions: n/a
Fixed upstream versions: v4.1.0
Upstream repository: https://gitlab.freedesktop.org/slirp/libslirp
Upstream fix commit: c5927943
CVE-2019-15903: expat: heap-based buffer over-read via crafted XML input
Component: expat
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-09-04T00:00:00+00:00

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.


Affected upstream versions: n/a
Fixed upstream versions: R_2_2_8
Upstream repository: https://github.com/libexpat/libexpat
Upstream fix commit: c20b758c332d9a13afbbb276d30db1d183a85d43
CVE-2019-15916: kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-09-04T00:00:00+00:00

A flaw that allowed an attacker to leak kernel memory was found in the network subsystem where an attacker with permissions to create tun/tap devices can create a denial of service and panic the system.


Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 895a5e96dbd6386c8e78e5b78e067dcc67b7f0ab
CVE-2019-15917: kernel: use-after-free in drivers/bluetooth/hci_ldisc.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-09-04T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of the HCI UART driver. A local attacker with access permissions to the Bluetooth device can issue an ioctl, which triggers the hci_uart_set_proto() function in drivers/bluetooth/hci_ldisc.c. The flaw in this function can cause memory corruption or a denial of service because of a use-after-free issue when the hci_uart_register_dev() fails.

Statement: This flaw is rated as a Moderate as it requires the local attacker to have permissions to issue ioctl commands to the bluetooth device and bluetooth hardware to be present.

Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 56897b217a1d0a91c9920cb418d6b3fe922f590a
CVE-2019-15919: kernel: use-after-free in SMB2_write function in fs/cifs/smb2pdu.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-09-04T00:00:00+00:00

An flaw was discovered in the Linux kernel's CIFS client implementation. While issuing an SMB2_write, a value can be used after it was intended to be freed when CIFS function tracing is enabled. Even though the data is used after being freed, using it to for privilege escalation does not seem possible.


Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 6a3eb3360667170988f8a6477f6686242061488a
CVE-2019-15920: kernel: use-after-free information leak in SMB2_read
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2019-09-04T00:00:00+00:00

An issue was discovered in the Linux kernel's implementation of the CIFS protocol. The SMB2_read function has a possible use-after-free when CIFS function tracing is enabled. While data is used after being freed, it is has not been determined how it could be used for privilege escalation.


Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 088aaf17aa79300cab14dbee2569c58cfafd7d6e
CVE-2019-15921: kernel: memory leak in genl_register_family() in net/netlink/genetlink.c
Component: kernel
Severity: Low
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-09-04T00:00:00+00:00

A flaw was found in the genl_register_family function in the Linux kernel. An attacker able to induce the error conditions could use this flaw to crash the system. The highest threat from this vulnerability is to system availability.

Statement: This issue is rated as having Low impact because of the preconditions needed to trigger the error/resource cleanup code path (system-wide out-of-memory condition, high privileges or physical access). The generic netlink is a way for kernel modues to easily communicate with userspace using netlink. genl_register_family is thus called by kernel modules (code) only and it's hard for an attacker to invoke (module reloads?) it let alone fail on the right place.

Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ceabee6c59943bdd5e1da1a6a20dc7ee5f8113a2