CVE-2019-19813

Published: 17 December 2019

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c. This is related to mutex_can_spin_on_owner in kernel/locking/mutex.c, __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and btrfs_insert_delayed_items in fs/btrfs/delayed-inode.c.

From the Ubuntu security team

It was discovered that the btrfs file system implementation in the Linux kernel did not properly validate file system metadata in some situations. An attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash).

Notes

As of 2020-01-09, no upstream fix is available

upstream developer asserts in suse bug that the enhanced
btrfs tree-checker addresses this issue, which was backported to at
least the 4.4 kernel.

Priority

Low

CVSS 3 base score: 5.5

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19813
• https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19813
• https://ubuntu.com/security/notices/USN-4414-1
• https://ubuntu.com/security/notices/USN-4709-1
• https://ubuntu.com/security/notices/USN-4708-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.suse.com/show_bug.cgi?id=1159435