Use-after-free in Linux kernel - CVE-2019-11815

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a race condition that leads to use-after-free error when TCP packets in rds_tcp_kill_sock() function in net/rds/tcp.c. A remote unauthenticated attacker can specially crafted TCP packets to the affected system, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Affected software

How to mitigate CVE-2019-11815

External References

• http://www.securityfocus.com/bid/108283
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb66ddd156203daefb8d71158036b27b0e2caf63
• https://github.com/torvalds/linux/commit/cb66ddd156203daefb8d71158036b27b0e2caf63

Related Security Bulletins

• Remote code execution in Linux kernel TCP/IP implementation
• Amazon Linux AMI update for kernel