Linux Kernel up to 5.2.9 XFS File System fs/xfs/xfs_iops.c xfs_setattr_nonsize resource management

Summaryinfo

A vulnerability identified as problematic has been detected in Linux Kernel up to 5.2.9. This impacts the function xfs_setattr_nonsize of the file fs/xfs/xfs_iops.c of the component XFS File System. The manipulation leads to resource management. This vulnerability is referenced as CVE-2019-15538. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.2.9 (Operating System) and classified as problematic. This issue affects the function xfs_setattr_nonsize of the file fs/xfs/xfs_iops.c of the component XFS File System. The manipulation with an unknown input leads to a resource management vulnerability. Using CWE to declare the problem leads to CWE-399. Impacted is availability. The summary by CVE is:

An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.

The weakness was published 08/25/2019 (Website). The advisory is shared at lists.fedoraproject.org. The identification of this vulnerability is CVE-2019-15538 since 08/25/2019. The attack may be initiated remotely. A simple authentication is required for exploitation. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 208643 (CentOS 7 : kernel-alt (RHSA-2020:2104)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (208643). Similar entries are available at VDB-140692, VDB-140890, VDB-142076 and VDB-142077. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.2.7
• 5.2.8
• 5.2.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion