CVE-2019-5188

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Affected

E2fsprogs

CVSS v3.1 NVD

6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 CISCO

7.5 HIGHCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 NVD

4.4 MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P

EPSS

1.08% chance of exploitation in the next 30 days, 65th percentile

Published

2020-01-08

Updated

2026-10-14

Proof-of-concept exploits (1)

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973

Security advisories

• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00004.html
• https://lists.debian.org/debian-lts-announce/2020/03/msg00030.html
• https://lists.debian.org/debian-lts-announce/2020/07/msg00021.html
• https://security.netapp.com/advisory/ntap-20220506-0001
• https://usn.ubuntu.com/4249-1

References

• CVE Record
• NVD entry