A vulnerability, which was classified as critical, has been found in Ubuntu Linux 5.0/5.3 (Operating System). Affected by this issue is the function call_mmap of the component Overlayfs/shiftfs. The manipulation as part of a Variable leads to a operation after expiration vulnerability (Underflow). Using CWE to declare the problem leads to CWE-672. The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. On upstream kernels this is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patchs change mmap_region() to replace the fput() using a local variable with vma_fput(), which will fput() vm_file, leading to a refcount underflow.

The weakness was shared 04/24/2020. This vulnerability is handled as CVE-2019-15794 since 08/29/2019. Local access is required to approach this attack. The requirement for exploitation is a simple authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/24/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries 154333, 154332 and 154331 are related to this item.

Productinfo

Type

• Operating System

Vendor

• Ubuntu

Name

• Linux

Version

• 5.0
• 5.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion