CVE-2019-19814: linux-libc-dev - Out-of-Bounds Write in __remove_dirty_segment in fs/f2fs/segment.c
Summary
CVE-2019-19814: In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bounded by the number of dirty types (8) but the array index can e... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package that provides the Linux kernel headers for use by glibc and other C libraries. It allows developers to compile and build applications that interact with the Linux kernel. The vulnerability (CVE-2019-19814) affects the version 6.1.90-1 of the linux-libc-dev package. This vulnerability is related to the f2fs filesystem image and specifically impacts the __remove_dirty_segment function in the fs/f2fs/segment.c file.
Vulnerability Detail
The vulnerability in linux-libc-dev (CVE-2019-19814) allows an attacker to trigger an out-of-bounds write access in the __remove_dirty_segment function. When a crafted f2fs filesystem image is mounted, an array used in the function is bounded by the number of dirty types (8), but the array index can exceed this limit. This can lead to a slab-out-of-bounds write access, potentially resulting in a denial-of-service (DoS) or arbitrary code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they do not mount untrusted or malicious f2fs filesystem images.
Conclusion
The vulnerability (CVE-2019-19814) in the linux-libc-dev package can lead to an out-of-bounds write access, potentially resulting in a denial-of-service (DoS) or arbitrary code execution. It is crucial to update the linux-libc-dev package to a patched version and regularly apply security updates to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides the Linux kernel headers for use by glibc and other C libraries. It allows developers to compile and build applications that interact with the Linux kernel.
The impact of CVE-2019-19814 can be severe, potentially leading to a denial-of-service (DoS) or arbitrary code execution. An attacker could exploit this vulnerability by mounting a crafted f2fs filesystem image.
To fix the vulnerability, it is recommended to update the linux-libc-dev package to a version that includes the patch for CVE-2019-19814. Users should check for available updates from their Linux distribution's package repositories and apply the latest security patches.
While no specific workaround is mentioned for this vulnerability, users can mitigate the risk by ensuring they do not mount untrusted or malicious f2fs filesystem images.
You can find more information about CVE-2019-19814 on the National Vulnerability Database (NVD) website: https://nvd.nist.gov/vuln/detail/CVE-2019-19814
Related vulnerabilities
Recent vulnerabilities recorded for linux.
