In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), which casts file->private_data, a void* that points to a filesystem-dependent type, to a "struct shiftfs_file_info *". As the private_data is not required to be a pointer, an attacker can use this to cause a denial of service or possibly execute arbitrary code.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-gcpUpgrade linux-image-5.0.0-35-genericUpgrade linux-image-oracleUpgrade linux-image-gkeUpgrade linux-image-gke-5.0Upgrade linux-image-5.3.0-1007-azureUpgrade linux-image-5.0.0-1021-awsUpgrade linux-image-virtualUpgrade linux-image-oem-osp1Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-lowlatencyUpgrade linux-image-5.0.0-35-lowlatencyUpgrade linux-image-raspi2Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.0.0-1007-oracleUpgrade linux-image-5.0.0-1022-raspi2Upgrade linux-image-5.3.0-1008-gcpUpgrade linux-image-5.0.0-1025-azureUpgrade linux-image-generic-lpaeUpgrade linux-image-5.0.0-35-generic-lpaeUpgrade linux-image-awsUpgrade linux-image-5.3.0-1007-kvmUpgrade linux-image-5.0.0-1025-gcpUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.0.0-1022-kvmUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-5.3.0-1012-raspi2Upgrade linux-image-5.3.0-22-lowlatencyUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.3.0-22-generic-lpaeUpgrade linux-image-kvmUpgrade linux-image-5.3.0-1007-awsUpgrade linux-image-5.3.0-1006-oracleUpgrade linux-image-5.0.0-1025-gkeUpgrade linux-image-5.0.0-1027-oem-osp1Upgrade linux-image-snapdragonUpgrade linux-image-5.3.0-22-snapdragonUpgrade linux-image-genericUpgrade linux-image-azureUpgrade linux-image-5.3.0-22-generic | Nov 14, 2019 | Nov 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub