Refcount Underflow Vulnerability in Linux Kernel Overlayfs and Shiftfs
Summary
CVE-2019-15794: Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. Overlayfs and shiftfs are file system layers that allow for the management of files and directories in a flexible manner. This vulnerability affects specific versions of the Linux kernel included in Debian distributions, particularly those that utilize Overlayfs and shiftfs, which can lead to critical issues in file handling and system stability.
Vulnerability Detail
CVE-2019-15794 is a vulnerability found in Overlayfs and shiftfs within the Linux kernel. It arises from the improper handling of the vma->vm_file reference in mmap handlers. When an error occurs, the original file reference is not restored, leading to a reference count underflow when the system attempts to release the file. This issue is particularly concerning as it can result in system crashes or data corruption, especially in environments that rely heavily on these file systems. The vulnerability is exacerbated by changes made in the aufs patches, which alter the behavior of mmap_region() and can lead to dereferencing issues.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using Overlayfs and shiftfs until the kernel is updated. This may involve switching to alternative file systems that do not exhibit this vulnerability. Additionally, careful monitoring of file operations can help mitigate potential risks during this period.
Conclusion
CVE-2019-15794 presents a significant risk to systems using Overlayfs and shiftfs in the Linux kernel. Users are strongly advised to upgrade their kernel to mitigate this vulnerability and ensure system stability. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2019-15794 is a vulnerability in the Linux kernel's Overlayfs and shiftfs that can lead to a reference count underflow, potentially causing system instability.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor for vulnerabilities.
The vulnerability can lead to system crashes, data corruption, and instability in environments that utilize Overlayfs and shiftfs.
Yes, patches are available in the updated versions of the Linux kernel. Users should upgrade to at least version 5.16.7-1.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file. It provides real-time insights without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
