Use after free in Linux kernel - CVE-2019-3896

Vulnerability identifier: #VU92784

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-3896

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code.

A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS).

Linux kernel
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server - AUS
kernel (Red Hat package)

Install update from vendor's repository.

kernel (Red Hat package) - addressed in versions 2.6.32-431.95.3.el6, 2.6.32-504.79.3.el6, 2.6.32-754.15.3.el6

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3896
• http://www.securityfocus.com/bid/108814
• https://support.f5.com/csp/article/K04327111
• https://security.netapp.com/advisory/ntap-20190710-0002/

• Use after free in Linux kernel
• Red Hat Enterprise Linux 6 update for kernel
• Red Hat Enterprise Linux 6 update for kernel
• Red Hat Enterprise Linux 6 update for kernel