Linux Kernel 5.0.21 f2fs Filesystem Image fs/f2fs/segment.c f2fs_build_segment_manager Argument out-of-bounds

Summaryinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel 5.0.21. The impacted element is the function f2fs_build_segment_manager of the file fs/f2fs/segment.c of the component f2fs Filesystem Image Handler. This manipulation as part of Argument causes out-of-bounds. This vulnerability is handled as CVE-2019-19449. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel 5.0.21 (Operating System). Affected by this vulnerability is the function f2fs_build_segment_manager of the file fs/f2fs/segment.c of the component f2fs Filesystem Image Handler. The manipulation as part of a Argument leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated).

The weakness was released 12/08/2019. This vulnerability is known as CVE-2019-19449 since 11/29/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/09/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-146790 and VDB-146789. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.0.21

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion