Type confusion in Linux kernel - CVE-2019-15792

Vulnerability identifier: #VU95689

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-15792

CWE-ID: CWE-843

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code.

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), which casts file->private_data, a void* that points to a filesystem-dependent type, to a 'struct shiftfs_file_info *'. As the private_data is not required to be a pointer, an attacker can use this to cause a denial of service or possibly execute arbitrary code.

Linux kernel
Ubuntu
linux-azure (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-hwe (Ubuntu package)
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-kvm (Ubuntu package)
linux-raspi2 (Ubuntu package)
linux-oem-osp1 (Ubuntu package)
linux-gke-5.0 (Ubuntu package)

Install update from vendor's repository.

linux-azure (Ubuntu package) - addressed in versions 5.0.0-1025.27~18.04.1, 5.0.0-1025.27, 5.3.0-1007.8
linux-gcp (Ubuntu package) - addressed in versions 5.0.0-1025.26~18.04.1, 5.0.0-1025.26, 5.3.0-1008.9
linux-oracle (Ubuntu package) - addressed in versions 5.0.0-1007.12, 5.3.0-1006.7
linux-hwe (Ubuntu package) - update to 5.0.0-35.38~18.04.1
linux (Ubuntu package) - addressed in versions 5.0.0-35.38, 5.3.0-22.24
linux-aws (Ubuntu package) - addressed in versions 5.0.0-1021.24, 5.3.0-1007.8
linux-kvm (Ubuntu package) - addressed in versions 5.0.0-1022.24, 5.3.0-1007.8
linux-raspi2 (Ubuntu package) - update to 5.0.0-1022.23
linux-oem-osp1 (Ubuntu package) - update to 5.0.0-1027.31
linux-gke-5.0 (Ubuntu package) - update to 5.0.0-1025.26~18.04.1

• https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=5df147c8140efc71ac0879ae3b0057f577226d4c
• https://usn.ubuntu.com/usn/usn-4183-1
• https://usn.ubuntu.com/usn/usn-4184-1

• Type confusion in Linux kernel
• Ubuntu update for linux, linux-aws, linux-azure and more
• Ubuntu update for linux, linux-aws, linux-azure and more