In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), which casts file->private_data, a void* that points to a filesystem-dependent type, to a "struct shiftfs_file_info *". As the private_data is not required to be a pointer, an attacker can use this to cause a denial of service or possibly execute arbitrary code.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-5.3.0-1012-raspi2Upgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-5.3.0-22-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-5.3.0-22-generic-lpaeUpgrade linux-image-azureUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.3.0-1007-awsUpgrade linux-image-5.3.0-22-snapdragonUpgrade linux-image-genericUpgrade linux-image-5.0.0-1022-kvmUpgrade linux-image-5.3.0-1006-oracleUpgrade linux-image-snapdragonUpgrade linux-image-5.0.0-1027-oem-osp1Upgrade linux-image-5.0.0-1025-gkeUpgrade linux-image-5.3.0-22-genericUpgrade linux-image-5.3.0-1007-kvmUpgrade linux-image-oracleUpgrade linux-image-5.0.0-1022-raspi2Upgrade linux-image-5.0.0-1025-azureUpgrade linux-image-5.0.0-35-genericUpgrade linux-image-awsUpgrade linux-image-5.3.0-1008-gcpUpgrade linux-image-5.0.0-35-lowlatencyUpgrade linux-image-raspi2Upgrade linux-image-gke-5.0Upgrade linux-image-5.3.0-1007-azureUpgrade linux-image-5.0.0-1021-awsUpgrade linux-image-lowlatencyUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-virtualUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.0.0-1025-gcpUpgrade linux-image-generic-lpaeUpgrade linux-image-gkeUpgrade linux-image-5.0.0-1007-oracleUpgrade linux-image-gcpUpgrade linux-image-5.0.0-35-generic-lpaeUpgrade linux-image-oem-osp1 | Nov 14, 2019 | Nov 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub