Summaryinfo

A vulnerability identified as critical has been detected in Ubuntu Linux 5.0/5.3. Affected by this issue is the function shiftfs_btrfs_ioctl_fd_replace of the component shiftfs. The manipulation leads to operation after expiration (Underflow). This vulnerability is documented as CVE-2019-15791. The attack needs to be performed locally. Additionally, an exploit exists. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Detailsinfo

A vulnerability was found in Ubuntu Linux 5.0/5.3 (Operating System). It has been rated as critical. This issue affects the function shiftfs_btrfs_ioctl_fd_replace of the component shiftfs. The manipulation with an unknown input leads to a operation after expiration vulnerability (Underflow). Using CWE to declare the problem leads to CWE-672. The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the btrfs ioctl completes this fd is closed, which then puts a reference to that file, leading to a refcount underflow.

The weakness was released 04/24/2020. The identification of this vulnerability is CVE-2019-15791 since 08/29/2019. Attacking locally is a requirement. A simple authentication is required for exploitation. Technical details as well as a public exploit are known.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47693). Entries connected to this vulnerability are available at VDB-154334, VDB-154333 and VDB-154332. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Ubuntu

Name

• Linux

Version

• 5.0
• 5.3

License

• open-source

Website

• Vendor: https://www.ubuntu.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion