In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), which casts file->private_data, a void* that points to a filesystem-dependent type, to a "struct shiftfs_file_info *". As the private_data is not required to be a pointer, an attacker can use this to cause a denial of service or possibly execute arbitrary code.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-virtualUpgrade linux-image-gke-5.0Upgrade linux-image-5.0.0-35-genericUpgrade linux-image-5.3.0-1007-azureUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.0.0-1025-gcpUpgrade linux-image-5.0.0-1021-awsUpgrade linux-image-lowlatencyUpgrade linux-image-5.0.0-1025-azureUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-osp1Upgrade linux-image-raspi2Upgrade linux-image-oracleUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.0.0-1022-raspi2Upgrade linux-image-5.3.0-1008-gcpUpgrade linux-image-awsUpgrade linux-image-5.3.0-1007-kvmUpgrade linux-image-5.0.0-1007-oracleUpgrade linux-image-5.0.0-35-generic-lpaeUpgrade linux-image-gcpUpgrade linux-image-gkeUpgrade linux-image-5.0.0-35-lowlatencyUpgrade linux-image-genericUpgrade linux-image-5.3.0-22-lowlatencyUpgrade linux-image-snapdragonUpgrade linux-image-5.0.0-1027-oem-osp1Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.0.0-1022-kvmUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-5.0.0-1025-gkeUpgrade linux-image-5.3.0-22-snapdragonUpgrade linux-image-5.3.0-1006-oracleUpgrade linux-image-azureUpgrade linux-image-5.3.0-22-genericUpgrade linux-image-5.3.0-1012-raspi2Upgrade linux-image-5.3.0-22-generic-lpaeUpgrade linux-image-kvmUpgrade linux-image-5.3.0-1007-aws | Nov 14, 2019 | Nov 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub