Use-after-free in Linux kernel - CVE-2019-11815

Vulnerability identifier: #VU18434

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11815

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a race condition that leads to use-after-free error when TCP packets in rds_tcp_kill_sock() function in net/rds/tcp.c. A remote unauthenticated attacker can specially crafted TCP packets to the affected system, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Linux kernel
Amazon Linux AMI
Ubuntu
linux (Ubuntu package)
linux-raspi2 (Ubuntu package)
linux-kvm (Ubuntu package)
linux-aws (Ubuntu package)
linux-snapdragon (Ubuntu package)
linux-gcp (Ubuntu package)

Install updates from vendor's website.

Linux kernel - update to 5.0.8
linux (Ubuntu package) - addressed in versions 4.4.0-150.176, 5.0.0-16.17
linux-raspi2 (Ubuntu package) - update to 4.4.0-1110.118
linux-kvm (Ubuntu package) - addressed in versions 4.4.0-1047.53, 5.0.0-1007.7
linux-aws (Ubuntu package) - addressed in versions 4.4.0-1084.94, 5.0.0-1007.7
linux-snapdragon (Ubuntu package) - addressed in versions 4.4.0-1114.119, 5.0.0-1013.13
linux-gcp (Ubuntu package) - update to 5.0.0-1007.7

• http://www.securityfocus.com/bid/108283
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb66ddd156203daefb8d71158036b27b0e2caf63
• https://github.com/torvalds/linux/commit/cb66ddd156203daefb8d71158036b27b0e2caf63

• Remote code execution in Linux kernel TCP/IP implementation
• Amazon Linux AMI update for kernel
• Ubuntu update for linux, linux-aws, linux-kvm and more
• Ubuntu update for linux, linux-aws, linux-gcp and more