UBUNTU-CVE-2019-19448
In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure.
02 / AFFECTED SOFTWARE
Affected packages
1 explicit affected versions
14 explicit affected versions
84 explicit affected versions
45 explicit affected versions
6 explicit affected versions
6 explicit affected versions
191 explicit affected versions
50 explicit affected versions
14 explicit affected versions
31 explicit affected versions
5 explicit affected versions
57 explicit affected versions
23 explicit affected versions
1 explicit affected versions
1 explicit affected versions
1 explicit affected versions
7 explicit affected versions
7 explicit affected versions
18 explicit affected versions
52 explicit affected versions
14 explicit affected versions
7 explicit affected versions
10 explicit affected versions
30 explicit affected versions
51 explicit affected versions
29 explicit affected versions
1 explicit affected versions
1 explicit affected versions
29 explicit affected versions
13 explicit affected versions
47 explicit affected versions
1 explicit affected versions
16 explicit affected versions
26 explicit affected versions
10 explicit affected versions
11 explicit affected versions
86 explicit affected versions
14 explicit affected versions
2 explicit affected versions
50 explicit affected versions
6 explicit affected versions
54 explicit affected versions
1 explicit affected versions
115 explicit affected versions
8 explicit affected versions
63 explicit affected versions
1 explicit affected versions
9 explicit affected versions
4 explicit affected versions
1 explicit affected versions
4 explicit affected versions
1 explicit affected versions
8 explicit affected versions
73 explicit affected versions
4 explicit affected versions
32 explicit affected versions
44 explicit affected versions
16 explicit affected versions
38 explicit affected versions
9 explicit affected versions
93 explicit affected versions
4 explicit affected versions
76 explicit affected versions
28 explicit affected versions
40 explicit affected versions
4 explicit affected versions
43 explicit affected versions
1 explicit affected versions
12 explicit affected versions
8 explicit affected versions
4 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure.
05 / REFERENCES