Integer underflow in Linux kernel - CVE-2019-15791

Vulnerability identifier: #VU95688

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-15791

CWE-ID: CWE-191

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code.

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the btrfs ioctl completes this fd is closed, which then puts a reference to that file, leading to a refcount underflow.

Linux kernel
Ubuntu
linux-azure (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-hwe (Ubuntu package)
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-kvm (Ubuntu package)
linux-raspi2 (Ubuntu package)
linux-oem-osp1 (Ubuntu package)
linux-gke-5.0 (Ubuntu package)

Install update from vendor's repository.

linux-azure (Ubuntu package) - addressed in versions 5.0.0-1025.27~18.04.1, 5.0.0-1025.27, 5.3.0-1007.8
linux-gcp (Ubuntu package) - addressed in versions 5.0.0-1025.26~18.04.1, 5.0.0-1025.26, 5.3.0-1008.9
linux-oracle (Ubuntu package) - addressed in versions 5.0.0-1007.12, 5.3.0-1006.7
linux-hwe (Ubuntu package) - update to 5.0.0-35.38~18.04.1
linux (Ubuntu package) - addressed in versions 5.0.0-35.38, 5.3.0-22.24
linux-aws (Ubuntu package) - addressed in versions 5.0.0-1021.24, 5.3.0-1007.8
linux-kvm (Ubuntu package) - addressed in versions 5.0.0-1022.24, 5.3.0-1007.8
linux-raspi2 (Ubuntu package) - update to 5.0.0-1022.23
linux-oem-osp1 (Ubuntu package) - update to 5.0.0-1027.31
linux-gke-5.0 (Ubuntu package) - update to 5.0.0-1025.26~18.04.1

• https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=601a64857b3d7040ca15c39c929e6b9db3373ec1
• https://usn.ubuntu.com/usn/usn-4183-1
• https://usn.ubuntu.com/usn/usn-4184-1

• Integer underflow in Linux kernel
• Ubuntu update for linux, linux-aws, linux-azure and more
• Ubuntu update for linux, linux-aws, linux-azure and more