A race condition vulnerability tracked as CVE-2019-11815 has been found in Linux machines running distros with kernels prior to 5.0.8. The flaw could lead to a use after free, related to net namespace cleanup, exposing vulnerable systems to remote attacks, as explained in the official advisory.
More about CVE-2019-11815 Linux Kernel Vulnerability
Specially crafted TCP packets can be used to launch attacks against Linux boxes. This could trigger use-after-free errors and further enable hackers to execute arbitrary code. The vulnerability is severe, having a 8.1 severity base score, and it can be exploited without the need of user interaction.
However, the exploit involving CVE-2019-11815 is quite complex thus making the exploitability score low (2.2), with impact score limited to 5.9.
The use of previously-freed memory can have any number of adverse consequences, ranging from the corruption of valid data to the execution of arbitrary code, depending on the instantiation and timing of the flaw, the advisory adds.
The easiest way that could lead to data corruption involves the system’s reuse of freed memory. Use-after-free errors are associated with two causes – error conditions and confusion over the part of the program that is responsible for freeing the memory.
In this scenario, the memory in question is allocated to another pointer validly at some point after it has been freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process.
A patch has already been issued and the vulnerability is fixed in Linux kernel 5.0.8 version.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: