CVE-2019-8912

Published: 18 February 2019

In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr.

From the Ubuntu Security Team

It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

NVD has published CVSS metrics that state that the attack vector is
"Network" which results in a CRITICAL CVSS score but that does not match
Ubuntu's assessment. The attack vector is "Local" since AF_ALG is a address
family that strictly operates locally between a userspace process and the
kernel crypto API and the attack requires a specific sequence of operations
to be performed on the file descriptor that represents the socket.
This has been addressed in a more generic manner, to fix
other network families, by this commit in the net tree:
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=ff7b11aa481f682e0e9711abfeb7d03f5cd612bf

Status

Severity score breakdown

References

• https://ubuntu.com/security/notices/USN-3930-1
• https://ubuntu.com/security/notices/USN-3930-2
• https://ubuntu.com/security/notices/USN-3931-1
• https://ubuntu.com/security/notices/USN-3931-2
• https://www.cve.org/CVERecord?id=CVE-2019-8912
• NVD
• Launchpad
• Debian