Slab Out-of-Bounds Read Vulnerability in Linux Kernel 5.0.21 Affecting Debian Packages
Summary
DEBIAN-CVE-2019-19449: In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (beca... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is designed to be robust and secure, but vulnerabilities can arise from various sources, including improper validation of inputs. This specific vulnerability affects multiple Debian versions, including Debian 11, 12, 13, and 14.
Vulnerability Detail
In the Linux kernel version 5.0.21, a vulnerability exists that allows an attacker to exploit a crafted f2fs filesystem image. This can lead to a slab-out-of-bounds read access in the function f2fs_build_segment_manager located in fs/f2fs/segment.c. The issue arises because the second argument to the function get_seg_entry is not properly validated, potentially allowing unauthorized access to memory and leading to system instability or data leakage.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid mounting untrusted f2fs filesystem images until the kernel is updated. This can help mitigate the risk of exploitation until a patch is applied.
Conclusion
The slab out-of-bounds read vulnerability in the Linux kernel 5.0.21 poses significant risks to Debian systems. It is crucial to update to a patched version of the kernel to mitigate these risks. Users should also be cautious about mounting untrusted filesystem images until the issue is resolved.
See every vulnerability recorded for linux →
FAQ
A slab-out-of-bounds read vulnerability occurs when a program reads data outside the allocated memory bounds, which can lead to unauthorized access to sensitive information or system crashes.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor and alert for open-source vulnerabilities.
The consequences may include unauthorized access to memory, system instability, and potential data leakage, which can compromise the security of the system.
Yes, any version of the Linux kernel that is higher than 5.0.21 should include patches that address this vulnerability.
If you cannot update your kernel immediately, avoid mounting untrusted f2fs filesystem images as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
