CVE-2019-11815: Bug in Linux Kernel Prior to Version 5.0.8
NEWS

CVE-2019-11815: Bug in Linux Kernel Prior to Version 5.0.8

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...

A race condition vulnerability tracked as CVE-2019-11815 has been found in Linux machines running distros with kernels prior to 5.0.8. The flaw could lead to a use after free, related to net namespace cleanup, exposing vulnerable systems to remote attacks, as explained in the official advisory.




More about CVE-2019-11815 Linux Kernel Vulnerability

Specially crafted TCP packets can be used to launch attacks against Linux boxes. This could trigger use-after-free errors and further enable hackers to execute arbitrary code. The vulnerability is severe, having a 8.1 severity base score, and it can be exploited without the need of user interaction.

However, the exploit involving CVE-2019-11815 is quite complex thus making the exploitability score low (2.2), with impact score limited to 5.9.

The use of previously-freed memory can have any number of adverse consequences, ranging from the corruption of valid data to the execution of arbitrary code, depending on the instantiation and timing of the flaw, the advisory adds.

Related:
Linux vulnerabilities could be entirely mitigated or ?decreased? to ?less-than-critical? severity via an OS design which is based on a verified microkernel.
Verified Microkernel: the Cure for All Linux OS Vulnerabilities?.

The easiest way that could lead to data corruption involves the system’s reuse of freed memory. Use-after-free errors are associated with two causes – error conditions and confusion over the part of the program that is responsible for freeing the memory.

In this scenario, the memory in question is allocated to another pointer validly at some point after it has been freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process.

A patch has already been issued and the vulnerability is fixed in Linux kernel 5.0.8 version.

Milena Dimitrova

An inspired writer and content manager who has been with SensorsTechForum for 4 years. Enjoys ‘Mr. Robot’ and fears ‘1984’. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles!

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...