CVE-2019-19319

In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call, aka CID-345c0dbf3a30.

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

4.4 MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.69% chance of exploitation in the next 30 days, 52nd percentile

Published

2019-11-27

Updated

2024-08-05

Proof-of-concept exploits (1)

• bobfuzzer/CVE/tree/master/CVE-2019-1931961★ · 2020-10-25

Security advisories

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
• https://security.netapp.com/advisory/ntap-20200103-0001
• https://usn.ubuntu.com/4391-1

References

• CVE Record
• NVD entry

Related

• CVE-2019-18885
• CVE-2019-19036
• CVE-2019-19037
• CVE-2019-19039
• CVE-2019-19318
• CVE-2019-19377