CVE-2019-19036
Published: 21 November 2019
btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.
From the Ubuntu Security Team
It was discovered that the btrfs file system implementation in the Linux kernel did not properly validate file system metadata in some situations. An attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash).
Notes
| Author | Note |
|---|---|
| tyhicks | Exploiting this vulnerability requires a crafted filesystem image to be mounted |
| sbeattie | likely addressed by the btrfs write time tree-checker, which would mean it is addressed for kernels back through 4.4.x |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
linux-hwe Launchpad, Ubuntu, Debian |
hirsute |
Does not exist
|
| upstream |
Released
(5.4~rc1)
|
|
| trusty |
Does not exist
|
|
| xenial |
Released
(4.15.0-112.113~16.04.1)
|
|
| bionic |
Released
(5.3.0-26.28~18.04.1)
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
|
linux-hwe-edge Launchpad, Ubuntu, Debian |
hirsute |
Does not exist
|
| upstream |
Released
(5.4~rc1)
|
|
| trusty |
Does not exist
|
|
| xenial |
Ignored
(end of life, was needs-triage)
|
|
| bionic |
Ignored
(end of life, was needs-triage)
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
|
linux-lts-xenial Launchpad, Ubuntu, Debian |
hirsute |
Does not exist
|
| bionic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| trusty |
Ignored
(was needs-triage ESM criteria)
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-lts-trusty Launchpad, Ubuntu, Debian |
hirsute |
Does not exist
|
| bionic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-aws Launchpad, Ubuntu, Debian |
hirsute |
Not vulnerable
(5.8.0-1018.20+21.04.1)
|
| focal |
Not vulnerable
(5.4.0-1005.5)
|
|
| xenial |
Ignored
(end of life, was needed)
|
|
| bionic |
Released
(4.15.0-1077.81)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Released
(5.3.0-1007.8)
|
|
| groovy |
Not vulnerable
(5.4.0-1009.9)
|
|
| trusty |
Ignored
(was needs-triage ESM criteria)
|
|
| upstream |
Released
(5.4~rc1)
|
|
|
linux-aws-5.4 Launchpad, Ubuntu, Debian |
hirsute |
Does not exist
|
| bionic |
Not vulnerable
(5.4.0-1018.18~18.04.1)
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-riscv Launchpad, Ubuntu, Debian |
hirsute |
Not vulnerable
(5.8.0-10.12+21.04.1)
|
| bionic |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Not vulnerable
(5.4.0-24.28)
|
|
| groovy |
Not vulnerable
(5.4.0-24.28)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-hwe-5.8 Launchpad, Ubuntu, Debian |
trusty |
Does not exist
|
| xenial |
Does not exist
|
|
| bionic |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| focal |
Not vulnerable
(5.8.0-23.24~20.04.1)
|
|
| upstream |
Released
(5.4~rc1)
|
|
|
linux-gke-5.4 Launchpad, Ubuntu, Debian |
trusty |
Does not exist
|
| xenial |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| bionic |
Not vulnerable
(5.4.0-1025.25~18.04.1)
|
|
| upstream |
Released
(5.4~rc1)
|
|
|
linux-gkeop-5.4 Launchpad, Ubuntu, Debian |
trusty |
Does not exist
|
| xenial |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| bionic |
Not vulnerable
(5.4.0-1001.1)
|
|
| upstream |
Released
(5.4~rc1)
|
|
|
linux-kvm Launchpad, Ubuntu, Debian |
focal |
Not vulnerable
(5.4.0-1004.4)
|
| xenial |
Ignored
(end of life, was needed)
|
|
| upstream |
Released
(5.4~rc1)
|
|
| trusty |
Does not exist
|
|
| bionic |
Released
(4.15.0-1069.70)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Released
(5.3.0-1007.8)
|
|
| groovy |
Not vulnerable
(5.4.0-1009.9)
|
|
| hirsute |
Not vulnerable
(5.8.0-1010.11+21.04.1)
|
|
|
linux-azure Launchpad, Ubuntu, Debian |
focal |
Not vulnerable
(5.4.0-1006.6)
|
| hirsute |
Not vulnerable
(5.8.0-1016.17+21.04.1)
|
|
| bionic |
Ignored
(end of life, was needs-triage)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Released
(5.3.0-1007.8)
|
|
| groovy |
Not vulnerable
(5.4.0-1010.10)
|
|
| trusty |
Released
(4.15.0-1091.101~14.04.1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Released
(4.15.0-1091.101~16.04.1)
|
|
|
linux-gcp Launchpad, Ubuntu, Debian |
hirsute |
Not vulnerable
(5.8.0-1015.15+21.04.1)
|
| bionic |
Ignored
(end of life, was needs-triage)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Released
(5.3.0-1008.9)
|
|
| focal |
Not vulnerable
(5.4.0-1005.5)
|
|
| groovy |
Not vulnerable
(5.4.0-1009.9)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Released
(4.15.0-1080.90~16.04.1)
|
|
|
linux-oracle Launchpad, Ubuntu, Debian |
hirsute |
Not vulnerable
(5.8.0-1014.14+21.04.1)
|
| bionic |
Released
(4.15.0-1048.52)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Released
(5.3.0-1006.7)
|
|
| focal |
Not vulnerable
(5.4.0-1005.5)
|
|
| groovy |
Not vulnerable
(5.4.0-1009.9)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Released
(4.15.0-1050.54~16.04.1)
|
|
|
linux Launchpad, Ubuntu, Debian |
hirsute |
Not vulnerable
(5.8.0-36.40+21.04.1)
|
| xenial |
Ignored
(end of life, was needed)
|
|
| upstream |
Released
(5.4~rc1)
|
|
| trusty |
Ignored
(was needs-triage ESM criteria)
|
|
| bionic |
Released
(4.15.0-109.110)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Released
(5.3.0-22.24)
|
|
| focal |
Not vulnerable
(5.4.0-9.12)
|
|
| groovy |
Not vulnerable
(5.4.0-26.30)
|
|
|
Patches: Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
|
linux-dell300x Launchpad, Ubuntu, Debian |
trusty |
Does not exist
|
| xenial |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| bionic |
Not vulnerable
(4.15.0-1005.8)
|
|
| upstream |
Released
(5.4~rc1)
|
|
|
linux-oem-5.10 Launchpad, Ubuntu, Debian |
trusty |
Does not exist
|
| xenial |
Does not exist
|
|
| bionic |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| focal |
Not vulnerable
(5.10.0-1008.9)
|
|
| upstream |
Released
(5.4~rc1)
|
|
|
linux-gkeop Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| focal |
Not vulnerable
(5.4.0-1008.9)
|
|
| upstream |
Released
(5.4~rc1)
|
|
| trusty |
Does not exist
|
|
| xenial |
Does not exist
|
|
|
linux-oem-osp1 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1065.70)
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Ignored
(end of life)
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-snapdragon Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1083.91)
|
| xenial |
Ignored
(end of standard support, was needed)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
|
linux-gcp-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1080.90)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-hwe-5.4 Launchpad, Ubuntu, Debian |
upstream |
Released
(5.4~rc1)
|
| bionic |
Not vulnerable
(5.4.0-37.41~18.04.1)
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| xenial |
Does not exist
|
|
|
linux-raspi-5.4 Launchpad, Ubuntu, Debian |
upstream |
Released
(5.4~rc1)
|
| bionic |
Not vulnerable
(5.4.0-1013.13~18.04.1)
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| xenial |
Does not exist
|
|
|
linux-oracle-5.4 Launchpad, Ubuntu, Debian |
upstream |
Released
(5.4~rc1)
|
| trusty |
Does not exist
|
|
| bionic |
Not vulnerable
(5.4.0-1019.19~18.04.1)
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| xenial |
Does not exist
|
|
|
linux-raspi2 Launchpad, Ubuntu, Debian |
xenial |
Ignored
(end of standard support, was needed)
|
| bionic |
Released
(4.15.0-1065.69)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Released
(5.3.0-1012.14)
|
|
| focal |
Ignored
(end of life, was needs-triage)
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
|
linux-aws-5.0 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-aws-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1016.17~18.04.1)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-aws-hwe Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Released
(4.15.0-1079.83~16.04.1)
|
|
|
linux-azure-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1091.101)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-azure-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1007.8~18.04.1)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-azure-5.4 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1020.20~18.04.1)
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-azure-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-gcp-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1008.9~18.04.1)
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-gcp-5.4 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1019.19~18.04.2)
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-gcp-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-gke-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1066.69)
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-gke-5.0 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1045.46)
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-gke-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1011.12~18.04.1)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-oem Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1091.101)
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Ignored
(end of life)
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
linux-oem-5.6 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| eoan |
Does not exist
|
|
| focal |
Not vulnerable
(5.6.0-1007.7)
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-oracle-5.0 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-oracle-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1011.12~18.04.1)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-raspi Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| eoan |
Does not exist
|
|
| focal |
Not vulnerable
(5.4.0-1007.7)
|
|
| groovy |
Not vulnerable
(5.4.0-1008.8)
|
|
| hirsute |
Not vulnerable
(5.8.0-1008.11+21.04.1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
|
linux-raspi2-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1017.19~18.04.1)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.4~rc1)
|
|
| xenial |
Does not exist
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.5 |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |