In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), which casts file->private_data, a void* that points to a filesystem-dependent type, to a "struct shiftfs_file_info *". As the private_data is not required to be a pointer, an attacker can use this to cause a denial of service or possibly execute arbitrary code.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-kvmUpgrade linux-image-azureUpgrade linux-image-5.3.0-1007-awsUpgrade linux-image-5.3.0-22-genericUpgrade linux-image-5.3.0-1012-raspi2Upgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-5.3.0-22-generic-lpaeUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-snapdragonUpgrade linux-image-5.0.0-1025-gkeUpgrade linux-image-5.0.0-1027-oem-osp1Upgrade linux-image-5.3.0-22-lowlatencyUpgrade linux-image-5.3.0-1006-oracleUpgrade linux-image-5.3.0-22-snapdragonUpgrade linux-image-5.0.0-1022-kvmUpgrade linux-image-gkeUpgrade linux-image-5.0.0-35-lowlatencyUpgrade linux-image-oem-osp1Upgrade linux-image-5.0.0-35-genericUpgrade linux-image-virtualUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-raspi2Upgrade linux-image-5.0.0-35-generic-lpaeUpgrade linux-image-gke-5.0Upgrade linux-image-5.3.0-1007-azureUpgrade linux-image-oracleUpgrade linux-image-5.3.0-1007-kvmUpgrade linux-image-5.0.0-1022-raspi2Upgrade linux-image-gcpUpgrade linux-image-5.0.0-1025-azureUpgrade linux-image-awsUpgrade linux-image-5.0.0-1021-awsUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.0.0-1025-gcpUpgrade linux-image-5.0.0-1007-oracleUpgrade linux-image-5.3.0-1008-gcp | Nov 14, 2019 | Nov 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub