Out-of-bounds read in Linux kernel - CVE-2019-19449

Vulnerability identifier: #VU34984

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-19449

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated).

Linux kernel
Ubuntu
linux-image-aws-hwe (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-4.15.0-162-lowlatency (Ubuntu package)
linux-image-4.15.0-162-generic-lpae (Ubuntu package)
linux-image-4.15.0-162-generic (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-dell300x (Ubuntu package)
linux-image-4.15.0-1030-dell300x (Ubuntu package)
linux-image-4.15.0-1083-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.15.0-1098-raspi2 (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1102-kvm (Ubuntu package)
linux-image-4.15.0-1111-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1115-aws (Ubuntu package)
linux-image-4.15.0-1115-snapdragon (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1126-azure (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-90-generic (Ubuntu package)
linux-image-5.4.0-90-lowlatency (Ubuntu package)
linux-image-5.4.0-90-generic-lpae (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1007-ibm (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-ibm-lts-20.04 (Ubuntu package)
linux-image-bluefield (Ubuntu package)
linux-image-5.4.0-1021-bluefield (Ubuntu package)
linux-image-5.4.0-1026-gkeop (Ubuntu package)
linux-image-gkeop-5.4 (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1046-raspi (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1049-kvm (Ubuntu package)
linux-image-5.4.0-1055-gke (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-oracle-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1057-gcp (Ubuntu package)
linux-image-5.4.0-1057-oracle (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-gcp-lts-20.04 (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-aws-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1059-aws (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1063-azure (Ubuntu package)
linux-image-5.8.0-1043-azure (Ubuntu package)

Install update from vendor's website.

linux-image-aws-hwe (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-virtual (Ubuntu package) - addressed in versions 4.15.0.162.151, 5.4.0.90.94
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.15.0.162.151, 5.4.0.90.94
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.162.151, 5.4.0.90.94
linux-image-generic (Ubuntu package) - addressed in versions 4.15.0.162.151, 5.4.0.90.94
linux-image-4.15.0-162-lowlatency (Ubuntu package) - update to 4.15.0-162.170
linux-image-4.15.0-162-generic-lpae (Ubuntu package) - update to 4.15.0-162.170
linux-image-4.15.0-162-generic (Ubuntu package) - update to 4.15.0-162.170
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.210.193
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.210.193
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.210.193
linux-image-dell300x (Ubuntu package) - update to 4.15.0.1030.32
linux-image-4.15.0-1030-dell300x (Ubuntu package) - update to 4.15.0-1030.35
linux-image-4.15.0-1083-oracle (Ubuntu package) - update to 4.15.0-1083.91
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1083.93
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.15.0.1098.96, 5.4.0.1046.81
linux-image-4.15.0-1098-raspi2 (Ubuntu package) - update to 4.15.0-1098.104
linux-image-kvm (Ubuntu package) - addressed in versions 4.15.0.1102.98, 5.4.0.1049.48
linux-image-4.15.0-1102-kvm (Ubuntu package) - update to 4.15.0-1102.104
linux-image-4.15.0-1111-gcp (Ubuntu package) - update to 4.15.0-1111.125
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1111.130
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1115.118
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1115.118
linux-image-4.15.0-1115-aws (Ubuntu package) - update to 4.15.0-1115.122
linux-image-4.15.0-1115-snapdragon (Ubuntu package) - update to 4.15.0-1115.124
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1126.99
linux-image-4.15.0-1126-azure (Ubuntu package) - update to 4.15.0-1126.139
linux-image-oem (Ubuntu package) - addressed in versions 5.4.0.90.94, 5.4.0.90.101~18.04.80, 5.4.0.202.198
linux-image-oem-osp1 (Ubuntu package) - addressed in versions 5.4.0.90.94, 5.4.0.90.101~18.04.80
linux-image-5.4.0-90-generic (Ubuntu package) - addressed in versions 5.4.0-90.101, 5.4.0-90.101~18.04.1
linux-image-5.4.0-90-lowlatency (Ubuntu package) - addressed in versions 5.4.0-90.101, 5.4.0-90.101~18.04.1
linux-image-5.4.0-90-generic-lpae (Ubuntu package) - addressed in versions 5.4.0-90.101, 5.4.0-90.101~18.04.1
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.90.101~18.04.80
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.90.101~18.04.80
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.90.101~18.04.80
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.90.101~18.04.80
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.90.101~18.04.80
linux-image-5.4.0-1007-ibm (Ubuntu package) - update to 5.4.0-1007.8
linux-image-ibm (Ubuntu package) - update to 5.4.0.1007.8
linux-image-ibm-lts-20.04 (Ubuntu package) - update to 5.4.0.1007.8
linux-image-bluefield (Ubuntu package) - update to 5.4.0.1021.22
linux-image-5.4.0-1021-bluefield (Ubuntu package) - update to 5.4.0-1021.24
linux-image-5.4.0-1026-gkeop (Ubuntu package) - addressed in versions 5.4.0-1026.27, 5.4.0-1026.27~18.04.1
linux-image-gkeop-5.4 (Ubuntu package) - addressed in versions 5.4.0.1026.27~18.04.27, 5.4.0.1026.29
linux-image-gkeop (Ubuntu package) - update to 5.4.0.1026.29
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1046.49
linux-image-5.4.0-1046-raspi (Ubuntu package) - addressed in versions 5.4.0-1046.50, 5.4.0-1046.50~18.04.1
linux-image-raspi (Ubuntu package) - update to 5.4.0.1046.81
linux-image-5.4.0-1049-kvm (Ubuntu package) - update to 5.4.0-1049.51
linux-image-5.4.0-1055-gke (Ubuntu package) - addressed in versions 5.4.0-1055.58, 5.4.0-1055.58~18.04.1
linux-image-gke-5.4 (Ubuntu package) - addressed in versions 5.4.0.1055.58~18.04.20, 5.4.0.1055.65
linux-image-gke (Ubuntu package) - addressed in versions 5.4.0.1055.65, 6.8.0-1015.19
linux-image-gcp (Ubuntu package) - addressed in versions 5.4.0.1057.43, 6.8.0-1019.21~22.04.1
linux-image-oracle-lts-20.04 (Ubuntu package) - update to 5.4.0.1057.57
linux-image-5.4.0-1057-gcp (Ubuntu package) - addressed in versions 5.4.0-1057.61, 5.4.0-1057.61~18.04.1
linux-image-5.4.0-1057-oracle (Ubuntu package) - addressed in versions 5.4.0-1057.61, 5.4.0-1057.61~18.04.1
linux-image-oracle (Ubuntu package) - addressed in versions 5.4.0.1057.61~18.04.37, 6.8.0-1017.18~22.04.1
linux-image-gcp-lts-20.04 (Ubuntu package) - update to 5.4.0.1057.67
linux-image-aws (Ubuntu package) - update to 5.4.0.1059.42
linux-image-aws-lts-20.04 (Ubuntu package) - update to 5.4.0.1059.62
linux-image-5.4.0-1059-aws (Ubuntu package) - addressed in versions 5.4.0-1059.62, 5.4.0-1059.62~18.04.1
linux-image-azure (Ubuntu package) - addressed in versions 5.4.0.1063.43, 5.8.0.1043.46~20.04.15, 6.8.0-1018.21~22.04.1
linux-image-azure-lts-20.04 (Ubuntu package) - update to 5.4.0.1063.61
linux-image-5.4.0-1063-azure (Ubuntu package) - addressed in versions 5.4.0-1063.66, 5.4.0-1063.66~18.04.1
linux-image-5.8.0-1043-azure (Ubuntu package) - update to 5.8.0-1043.46~20.04.1

• https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19449
• https://security.netapp.com/advisory/ntap-20200103-0001/

• Out-of-bounds read in Linux kernel
• Ubuntu update for linux-azure-5.8
• Ubuntu update for linux
• Ubuntu update for linux
• Ubuntu update for linux-bluefield