Use-after-free in Linux kernel - CVE-2019-15292

Vulnerability identifier: #VU20919

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-15292

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists in the "atalk_proc_exit" due to a use-after-free error, related to "net/appletalk/atalk_proc.c", "net/appletalk/ddp.c" and "net/appletalk/sysctl_net_atalk.c". A remote attacker can execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Linux kernel
Ubuntu
linux-kvm (Ubuntu package)
linux-hwe (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure (Ubuntu package)
linux (Ubuntu package)
linux-raspi2 (Ubuntu package)
linux-oracle (Ubuntu package)
linux-gke-4.15 (Ubuntu package)

Install updates from vendor's website.

Linux kernel - update to 5.0.9
linux-kvm (Ubuntu package) - update to 4.15.0-1043.43
linux-hwe (Ubuntu package) - update to 4.15.0-60.67~16.04.1
linux-gcp (Ubuntu package) - update to 4.15.0-1041.43
linux-azure (Ubuntu package) - update to 4.15.0-1056.61
linux (Ubuntu package) - update to 4.15.0-60.67
linux-raspi2 (Ubuntu package) - update to 4.15.0-1044.47
linux-oracle (Ubuntu package) - addressed in versions 4.15.0-1022.25~16.04.1, 4.15.0-1022.25
linux-gke-4.15 (Ubuntu package) - update to 4.15.0-1041.43

• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.9
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6377f787aeb945cae7abbb6474798de129e1f3ac
• https://usn.ubuntu.com/4115-1/
• https://usn.ubuntu.com/4118-1/

• Use-after-free in Linux kernel
• Ubuntu update for linux, linux-azure, linux-gcp and more