CVE-2019-11815

Published: 8 May 2019

An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.

From the Ubuntu Security Team

It was discovered that a race condition leading to a use-after-free existed in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel. The RDS protocol is blacklisted by default in Ubuntu. If enabled, a local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

I haven't yet seen evidence to support allegations that this is
remotely exploitable. Blacklisting rds.ko module is probably sufficient
to prevent the vulnerable code from loading. The default configuration of
the kmod package has included RDS in /etc/modprobe.d/blacklist-rare-network.conf
since 14.04 LTS. I'm dropping priority as a result.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11815
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb66ddd156203daefb8d71158036b27b0e2caf63
• https://ubuntu.com/security/notices/USN-4005-1
• https://ubuntu.com/security/notices/USN-4008-1
• https://ubuntu.com/security/notices/USN-4008-3
• https://ubuntu.com/security/notices/USN-4068-1
• https://ubuntu.com/security/notices/USN-4068-2
• https://ubuntu.com/security/notices/USN-4118-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1829055